The `Enterprise_Logging` extension logs requested data when save events were triggered on the website. This information was displayed to administrators with limited privileges that could view the audit log. Although these saved values were escaped before output, the keys were not, which made it possible to insert cross-site scripting (XSS) on this page.
Part of update Magento 2.2.6 and 2.1.15 Security Update
This vulnerability affects the following application versions:
- Magento 2.1.0
- Magento 2.1.0-rc1
- Magento 2.1.0-rc2
- Magento 2.1.0-rc3
- Magento 2.1.1
- Magento 2.1.2
- Magento 2.1.3
- Magento 2.1.4
- Magento 2.1.5
- Magento 2.1.6
- Magento 2.1.7
- Magento 2.1.8
- Magento 2.1.9
- Magento 2.1.10
- Magento 2.1.11
- Magento 2.1.12
- Magento 2.1.13
- Magento 2.1.14
- Magento 2.2.0
- Magento 2.2.0-rc2.0
- Magento 2.2.0-rc2.1
- Magento 2.2.0-rc2.2
- Magento 2.2.0-rc2.3
- Magento 2.2.0-rc3.0
- Magento 2.2.1
- Magento 2.2.2
- Magento 2.2.3
- Magento 2.2.4
- Magento 2.2.5