Hackers steal sensitive customer data from thousands of online stores that use Adobe tools

Home / Security, Vulnerabilities / Hackers steal sensitive customer data from thousands of online stores that use Adobe tools

Hackers steal sensitive customer data from thousands of online stores that use Adobe tools

October 4, 2024 cyberelias 0 Comments 1 tag

The bug, with a severity rating of CVSS 9.8 out of 10, can be used to read any files, including passwords and other secrets. “The typical attack strategy is to steal your secret crypt key from app/etc/env.php and use that to modify your CMS blocks via the Magento API,” Sansec said. “Then, attackers inject malicious Javascript to steal your customer’s data.”

Combined with another bug (CVE-2024-2961), attackers can also run code directly on customers’ servers and use that to install backdoors, the cybersecurity firm added.

Versions of Magento and Adobe Commerce vulnerable to a CosmicSting attack include 2.4.7 and earlier, 2.4.6-p5 and earlier, 2.4.5-p7 and earlier, and 2.4.4-p8 and earlier. Enterprises are advised to immediately patch and apply hotfix for the flow.

Tags: Security, Vulnerabilities

Explore More

Microsoft fails to collect critical security logs, exposing customers to risks

Widespread impact on security monitoring Microsoft acknowledged that the logging failure affected a range of key services. Microsoft Sentinel, a widely used security tool, suffered gaps in its logs, making

While the payload included the promised functionality, which itself accounts for piracy, it also delivered “sophisticated” malware directly onto users’ computers. Because Foxit’s installation directory resides in the “Program Files”

Apache geht auf die Jagd nach eigenen Fehler und macht fette Beute. monticello – shutterstock.com Eine neue Sicherheitslücke in Apache OFBiz, einem Java-basierten ERP-Framework für Geschäftsprozesse wie Buchhaltung und E-Commerce, ermöglicht