Hackers steal sensitive customer data from thousands of online stores that use Adobe tools

Home / Security, Vulnerabilities / Hackers steal sensitive customer data from thousands of online stores that use Adobe tools

Hackers steal sensitive customer data from thousands of online stores that use Adobe tools

October 4, 2024 cyberelias 0 Comments 1 tag

The bug, with a severity rating of CVSS 9.8 out of 10, can be used to read any files, including passwords and other secrets. “The typical attack strategy is to steal your secret crypt key from app/etc/env.php and use that to modify your CMS blocks via the Magento API,” Sansec said. “Then, attackers inject malicious Javascript to steal your customer’s data.”

Combined with another bug (CVE-2024-2961), attackers can also run code directly on customers’ servers and use that to install backdoors, the cybersecurity firm added.

Versions of Magento and Adobe Commerce vulnerable to a CosmicSting attack include 2.4.7 and earlier, 2.4.6-p5 and earlier, 2.4.5-p7 and earlier, and 2.4.4-p8 and earlier. Enterprises are advised to immediately patch and apply hotfix for the flow.

Tags: Security, Vulnerabilities

Explore More

Spectre flaw still haunts Intel and AMD chips, putting security at risk

Wikner and Razavi’s research found that even with the IBPB defense, Intel’s processors still allow branch predictions to be reused, leading to security leaks. “We found a microcode bug in

CISOs who delayed patching Palo Alto vulnerabilities now face real threat

“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet,” Palo Alto

Stress testing Mindgard deployed these two filters in front of ChatGPT 3.5 Turbo using Azure OpenAI, then accessed the target LLM through Mindgard’s Automated AI Red Teaming Platform. Two attack