Magento Warns E-Commerce Sites to Upgrade ASAP to Prevent Attacks

🗓️ 12 Nov 2019 18:13:18Reported by Tara SealsType

Magento urges immediate upgrade to defend against remote code-execution and prevent card-skimming attacks, warning against potential exploitation of a critical vulnerability

Reporter	Title	Published	Views	Family All 271
zdt	Magento 2.4.0 / 2.3.5p1 (and earlier) Arbitrary Code Execution 0day Exploit	24 Mar 202100:00	–	zdt
ATTACKERKB	CVE-2020-5135	12 Oct 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-24407	15 Oct 202023:00	–	attackerkb
Information Security Automation	Last Week’s Security news: Cisco ASA, BIG-IQ, vSphere, Solaris, Dlink, iPhone %s, DarkRadiation, Google schema, John McAfee	28 Jun 202110:59	–	avleonov
BDU FSTEC	The vulnerability of the Magento Commerce software platform for developing and managing online stores lies in the lack of measures to protect SQL query structures. This allows attackers to execute arbitrary SQL queries against the database in the target system and gain access to protected information.	12 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Magento Commerce software platform for developing and managing online stores lies in the lack of restrictions on file uploads, which allows attackers to execute arbitrary code.	17 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SonicOS operating systems lies in the lack of a mechanism to check the size of copied data. This allows attackers to execute arbitrary code or cause service failures.	17 Sep 202100:00	–	bdu_fstec
Circl	CVE-2019-8144	4 Feb 202415:21	–	circl
Circl	CVE-2020-24400	15 Oct 202023:29	–	circl
Circl	CVE-2020-24407	15 Oct 202023:29	–	circl

Source	Link
threatpost	www.threatpost.com/magecart-groups-attack-simultaneous-sites-in-card-theft-frenzy/149872/
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
threatpost	www.threatpost.com/newsletter-sign/
magento	www.magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
register	www.register.gotowebinar.com/register/3127445778613605890
magento	www.magento.com/security/patches/latest-magento-security-update-helps-protect-recently-reported-rce-vulnerability
threatpost	www.threatpost.com/magecart-infestations-saturate-web/148911/
attendee	www.attendee.gotowebinar.com/register/3127445778613605890
attendee	www.attendee.gotowebinar.com/register/3127445778613605890

12 Nov 2019 18:13Current

8.5High risk

Vulners AI Score8.5

EPSS0.26869