Important Magento Security Update – Zend Platform Vulnerability

While doing routine sanity checks, on of our QA Engineers, Sammy Shaar, was alerted about an important Magento security update. The vulnerability potentially allows an attacker to read any file on the web server where the Zend XMLRPC functionality is enabled. This might include password files, configuration files, and possibly even databases if they are stored on the same machine as the Magento web server. To see if you site has been affected, please see this page. Luckily, Magento has released patches for all supported versions:

To install the patch, place the patch file in the root of your Magento site and run the following command: patch -p0 < zendxml_fix.patch If you don't have ssh access or patch installed on your machine, please see this stack overflow post for alternative methods.