Important - Security Vulnerabilities Discovered in Popular Scripts
We’re always looking out for ways to better your experience with us on the service and security front. We’d like to draw your attention to new security vulnerabilities identified in two popular scripts - WordPress & Magneto. Please note that these issues are script-based and are not specific to our platform in any way.
Read on to know more about these vulnerabilities, assess whether you could be impacted and take preventive action.
WordPress Vulnerability
This is a new, serious vulnerability, announced recently which has the potential to cause some damage and disruption. Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed.
Impact:
If triggered by a logged-in administrator, under default settings the attacker can leverage the vulnerability to execute arbitrary code on the server via the plugin and theme editors.
Alternatively the attacker could change the administrator’s password, create new administrator accounts, or do whatever else the currently logged-in administrator can do on the target system. You can find more details about the impact and solution for the same by clicking here.
Steps you need to take:
We would request you to go through the recommendations and update your Wordpress website using the patch available here.
Magento Vulnerability
This is a vulnerability that has been recently reported too. The vulnerability is actually comprised of a chain of several vulnerabilities that ultimately allow an unauthenticated attacker to execute PHP code on the web server.
Impact:
The attacker can bypass all security mechanisms and gains control of the store and its complete database, allowing credit card theft or any other administrative access into the system. This attack is not limited to any particular plugin or theme. All the vulnerabilities are present in the Magento core, and affects any default installation of both Community and Enterprise Editions
Steps you need to take:
If you are using the mentioned vulnerable versions of Magento, we would request you to patch it using the updates provided in the following link : http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/.
You can test whether your Magento website is vulnerability or not, using this tool.
We strongly recommend you access all your packages and patch them immediately to avoid any issues
Wednesday, May 6, 2015