Ttdfjt

Shifting tenses in the middle of narration

How much can I judge a company based on a phone screening?

Causal Diagrams using Wolfram?

How to gracefully leave a company you helped start?

Why does Japan use the same type of AC power outlet as the US?

Why does the cable resistance jump from a low value to high value at a particular frequency?

What is the prop for Thor's hammer made of?

What kind of liquid can be seen 'leaking' from the upper surface of the wing of a Boeing 737-800?

How can I find an old paper when the usual methods fail?

What are the odds of rolling specific ability score totals in D&D?

Weird resistor with dots around it

K-Type Thermocouple, Instrumentation Op-Amp and Arduino

What is the hottest thing in the universe?

(A room / an office) where an artist works

Bringing Power Supplies on Plane?

What can Amex do if I cancel their card after using the sign up bonus miles?

Word for an event that will likely never happen again

What would it take to get a message to another star?

How far did Gandalf and the Balrog drop from the bridge in Moria?

Why aren’t there water shutoff valves for each room?

Is it really Security Misconfiguration to show a version number?

Why did IBM make the PC BIOS source code public?

Are there any cons in using rounded corners for bar graphs?

What are the advantages of this gold finger shape?

Magento 2, XSS Patch not detected (APPSEC-2143)

Not able to apply security patch SUPEE-6285Security Patch (SUPEE-6285) – Install Immediately In Magento 1.9.0.1How to check which modules are affected by security patch SUPEE-6788Does Magento 1.4.1.1 require patch SUPEE-6788?how to solve Magento vulnerability issueSecurity Patch SUPEE-10266 - Possible issues?Security Patch SUPEE-10570 - Possible issues?Security Patch SUPEE-10888 - Possible issues?Security Scan supee-10415 false positive?Want to install SUPEE-11086 patch for magento 1.9.2.0 version

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

0

In Magento security scan I got the below message for my Magento instance:

XS Vulnerability - Failed.
XSS Patch not detected (APPSEC-2143)

I am using Magento 2.2.3

How could I resolve this?

Is anyone have an idea about it?

magento2 security patches security-scan-tool

share|improve this question

asked Aug 3 at 7:01

Utsav GuptaUtsav Gupta

57222 silver badges1616 bronze badges

add a comment | 

0

In Magento security scan I got the below message for my Magento instance:

XS Vulnerability - Failed.
XSS Patch not detected (APPSEC-2143)

I am using Magento 2.2.3

How could I resolve this?

Is anyone have an idea about it?

magento2 security patches security-scan-tool

share|improve this question

asked Aug 3 at 7:01

Utsav GuptaUtsav Gupta

57222 silver badges1616 bronze badges

add a comment | 

In Magento security scan I got the below message for my Magento instance:

XS Vulnerability - Failed.
XSS Patch not detected (APPSEC-2143)

I am using Magento 2.2.3

How could I resolve this?

Is anyone have an idea about it?

magento2 security patches security-scan-tool

share|improve this question

asked Aug 3 at 7:01

Utsav GuptaUtsav Gupta

57222 silver badges1616 bronze badges

share|improve this question

asked Aug 3 at 7:01

Utsav GuptaUtsav Gupta

57222 silver badges1616 bronze badges

share|improve this question

asked Aug 3 at 7:01

Utsav GuptaUtsav Gupta

57222 silver badges1616 bronze badges

asked Aug 3 at 7:01

Utsav GuptaUtsav Gupta

57222 silver badges1616 bronze badges

asked Aug 3 at 7:01

Utsav GuptaUtsav Gupta

57222 silver badges1616 bronze badges

2 Answers
2

active

oldest

votes

0

This is fixed in 2.2.7 so have you considered an upgrade?

Although a custom theme can also cause this. Therefore you could go through an upgrade and still get the warning.

Try the upgrade on a public dev store if you can and try and scan this store first.

share|improve this answer

answered Aug 3 at 7:44

Dominic XigenDominic Xigen

3,25311 gold badge55 silver badges1818 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks, @Dominic Xigen for your response, but we do not wanna upgrade version, is there any other way?
  
  – Utsav Gupta
  22 hours ago
  

  
  
  
  

add a comment | 

0

I am able to fix by below patch

diff --git a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
index b20da68..26ef484 100644
--- a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
+++ b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
@@ -58,7 +58,7 @@ $schemaUrl = $block->getSchemaUrl();
<div class="swagger-ui-wrap">
<a id="logo" href="http://swagger.io">swagger</a>
<form id='api_selector'>
- <input id="input_baseUrl" type="hidden" value="<?= /* @escapeNotVerified */ $schemaUrl ?>"/>
+ <input id="input_baseUrl" type="hidden" value="<?= $block->escapeUrl($schemaUrl) ?>"/>
<div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div>
<div class='input'><a id="explore" href="#" data-sw-translate>apply</a></div>
</form>


Hope it will help some one

share|improve this answer

answered 2 days ago

Sunil PatelSunil Patel

1,53111 gold badge66 silver badges1212 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for your help. I tried the same in my instance and again check it with Magento Scanner but it is giving the same error. is there any other way?
  
  – Utsav Gupta
  22 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  have you confirm that patch applied?
  
  – Sunil Patel
  20 hours ago
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "479"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fmagento.stackexchange.com%2fquestions%2f284292%2fmagento-2-xss-patch-not-detected-appsec-2143%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

This is fixed in 2.2.7 so have you considered an upgrade?

Although a custom theme can also cause this. Therefore you could go through an upgrade and still get the warning.

Try the upgrade on a public dev store if you can and try and scan this store first.

share|improve this answer

answered Aug 3 at 7:44

Dominic XigenDominic Xigen

3,25311 gold badge55 silver badges1818 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks, @Dominic Xigen for your response, but we do not wanna upgrade version, is there any other way?
  
  – Utsav Gupta
  22 hours ago
  

  
  
  
  

add a comment | 

0

This is fixed in 2.2.7 so have you considered an upgrade?

Although a custom theme can also cause this. Therefore you could go through an upgrade and still get the warning.

Try the upgrade on a public dev store if you can and try and scan this store first.

share|improve this answer

answered Aug 3 at 7:44

Dominic XigenDominic Xigen

3,25311 gold badge55 silver badges1818 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks, @Dominic Xigen for your response, but we do not wanna upgrade version, is there any other way?
  
  – Utsav Gupta
  22 hours ago
  

  
  
  
  

add a comment | 

This is fixed in 2.2.7 so have you considered an upgrade?

Although a custom theme can also cause this. Therefore you could go through an upgrade and still get the warning.

Try the upgrade on a public dev store if you can and try and scan this store first.

share|improve this answer

answered Aug 3 at 7:44

Dominic XigenDominic Xigen

3,25311 gold badge55 silver badges1818 bronze badges

share|improve this answer

answered Aug 3 at 7:44

Dominic XigenDominic Xigen

3,25311 gold badge55 silver badges1818 bronze badges

answered Aug 3 at 7:44

Dominic XigenDominic Xigen

3,25311 gold badge55 silver badges1818 bronze badges

answered Aug 3 at 7:44

Dominic XigenDominic Xigen

3,25311 gold badge55 silver badges1818 bronze badges

0

I am able to fix by below patch

diff --git a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
index b20da68..26ef484 100644
--- a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
+++ b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
@@ -58,7 +58,7 @@ $schemaUrl = $block->getSchemaUrl();
<div class="swagger-ui-wrap">
<a id="logo" href="http://swagger.io">swagger</a>
<form id='api_selector'>
- <input id="input_baseUrl" type="hidden" value="<?= /* @escapeNotVerified */ $schemaUrl ?>"/>
+ <input id="input_baseUrl" type="hidden" value="<?= $block->escapeUrl($schemaUrl) ?>"/>
<div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div>
<div class='input'><a id="explore" href="#" data-sw-translate>apply</a></div>
</form>


Hope it will help some one

share|improve this answer

answered 2 days ago

Sunil PatelSunil Patel

1,53111 gold badge66 silver badges1212 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for your help. I tried the same in my instance and again check it with Magento Scanner but it is giving the same error. is there any other way?
  
  – Utsav Gupta
  22 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  have you confirm that patch applied?
  
  – Sunil Patel
  20 hours ago
  

  
  
  
  

add a comment | 

0

I am able to fix by below patch

diff --git a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
index b20da68..26ef484 100644
--- a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
+++ b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
@@ -58,7 +58,7 @@ $schemaUrl = $block->getSchemaUrl();
<div class="swagger-ui-wrap">
<a id="logo" href="http://swagger.io">swagger</a>
<form id='api_selector'>
- <input id="input_baseUrl" type="hidden" value="<?= /* @escapeNotVerified */ $schemaUrl ?>"/>
+ <input id="input_baseUrl" type="hidden" value="<?= $block->escapeUrl($schemaUrl) ?>"/>
<div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div>
<div class='input'><a id="explore" href="#" data-sw-translate>apply</a></div>
</form>


Hope it will help some one

share|improve this answer

answered 2 days ago

Sunil PatelSunil Patel

1,53111 gold badge66 silver badges1212 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for your help. I tried the same in my instance and again check it with Magento Scanner but it is giving the same error. is there any other way?
  
  – Utsav Gupta
  22 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  have you confirm that patch applied?
  
  – Sunil Patel
  20 hours ago
  

  
  
  
  

add a comment | 

I am able to fix by below patch

diff --git a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
index b20da68..26ef484 100644
--- a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
+++ b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml
@@ -58,7 +58,7 @@ $schemaUrl = $block->getSchemaUrl();
<div class="swagger-ui-wrap">
<a id="logo" href="http://swagger.io">swagger</a>
<form id='api_selector'>
- <input id="input_baseUrl" type="hidden" value="<?= /* @escapeNotVerified */ $schemaUrl ?>"/>
+ <input id="input_baseUrl" type="hidden" value="<?= $block->escapeUrl($schemaUrl) ?>"/>
<div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div>
<div class='input'><a id="explore" href="#" data-sw-translate>apply</a></div>
</form>


Hope it will help some one

share|improve this answer

answered 2 days ago

Sunil PatelSunil Patel

1,53111 gold badge66 silver badges1212 bronze badges

share|improve this answer

answered 2 days ago

Sunil PatelSunil Patel

1,53111 gold badge66 silver badges1212 bronze badges

answered 2 days ago

Sunil PatelSunil Patel

1,53111 gold badge66 silver badges1212 bronze badges

answered 2 days ago

Sunil PatelSunil Patel

1,53111 gold badge66 silver badges1212 bronze badges