Magento releases new security patch and version 1.9.2.1
Four security vulnerabilities were recently discovered in Magento and fixed in patch SUPEE-6482. They’re present in all versions of Magento (1.4/x – 1.9/x), so both Magento Community and Magento Enterprise stores are affected. So far, there are no reports of attacks exploiting these vulnerabilities to gain access to a Magento installation. Even so, it’s important to install the security patch or upgrade to 1.9.2.1 as soon as possible.
Which vulnerabilities have been fixed?
- Cross-site Scripting/Cache Poisoning [Magento Enterprise only]
- Allows attackers to harvest data such as credit card information by combining a modified host header with altered HTML and JavaScript code.
- Autoloaded File Inclusion in Magento SOAP API
- Depending on the PHP and server configuration, data can be accessed through a SOAP API integration.
- XSS in Gift Registry Search [Magento Enterprise only]
- Allows attackers to steal identities through the Gift Registry search by manipulating the cookie.
- SSRF Vulnerability in WSDL File
- Incorrect encoding of API password data.
Magento 1.9.2.1 update
Alongside the new Magento security patches, a new version is now available: Magento 1.9.2.1. Besides the issues listed above, it also fixes a number of other bugs.
