The `Enterprise_Logging` extension logs request data when save events are triggered on the website. This information is displayed to administrators with limited privileges that can view the audit log. Although these saved values are escaped before output, the keys were not, which made it possible to insert cross-site scripting (XSS) on this page.
Part of patch SUPEE-10752
This vulnerability affects the following application versions:
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4
- Magento 1.9.3.0
- Magento 1.9.3.1
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4
- Magento 1.9.3.6
- Magento 1.9.3.7
- Magento 1.9.3.8