Phishing gone: eBay patches to block session-jacking Magento holes

Vulnerability Lab researcher Hadji Samir says eBay has squashed three vulnerabilities in its Magento shopping platform that could permit session hijacking and man-in-the-middle attacks. The penetration tester disclosed this month the vulnerabilities along with proof-of-concept videos showing how attackers could steal session …

[Six_Degrees]

"Samir says the three vulnerabilities ranked as medium flaws attracting a security score averaging three"

What is a "security score"? Is a score of three bad? Good? Middling? What is the range, and which direction does it run from good to bad?

[Philip Lewis]

@ Six_Degrees

My conjecture is ...

a) The score range is 1..5

b) That in this case, the direction of "scoring" is irrelevant

YMMV :D

[gollux]

The WordPress of eCommerce, brought to you by Magento, an eBay company(tm)

A bazillion plugins, lots of them for "free" created by security naifs and amateur programmers posing as Magento Experts.