Magento, a popular e-commerce platform, released multiple security patches this year, several addressing critical and high credit card data breach vulnerabilities. Merchants that haven\u2019t deployed security patches, as required by PCI standards, are vulnerable to remote exploits that can compromise customer account and credit card data.<\/p>\n
One cross-site scripting (XSS) flaw potentially allows an attacker to add malicious JavaScript code to a comment via the PayFlow Pro payment module. The JavaScript code is executed server-side when the targeted site\u2019s administrator views the attacker\u2019s order.<\/p>\n
PCI Compliance Requirement 6: Develop and maintain secure systems and applications<\/strong>. All critical systems must have the most recently released software patches to prevent exploitation. <\/strong> The average merchant relies upon third party developers for web site maintenance, but unless specifically contracted to update the e-commerce software and add-on modules, don’t count on it.<\/p>\n Only 16.4% of organizations that had suffered a data breach were compliant with Requirement 6, compared to an average of 64% of organizations assessed by our QSAs in 2014- Verizon 2015 PCI Compliance Report.<\/p><\/blockquote>\n Payment gateway implementation requirements have changed over time as a result of cross-site scripting and cross-site request forgery (CSRF) to meet current PCI Compliance standards. Merchants should verify all components of their ecommerce ecosystem are current, and have a system for ongoing monitoring and updating.<\/p>\n RESOURCES<\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Magento, a popular e-commerce platform, released multiple security patches this year, several addressing critical and high credit card data breach vulnerabilities. Merchants that haven\u2019t deployed security patches, as required by PCI standards, are vulnerable to remote exploits that can compromise … Continue reading \n