I am trying the Magento Security Scanner in our projects however the scanner fails to detect that SUPEE-8788 is applied. We are using Magento installed via composer with a clean install.

Your Magento installation is vulnerable to the vulnerabilities addressed in SUPEE-8788. /js/mage/adminhtml/uploader/instance.js /fustyFlowFactory/ /skin/adminhtml/default/default/boxes.css ~background:url(images/blank.gif) repeat;~

I've confirmed that all files that were patched by SUPEE-8788 are equal to the ones in the zip file that you can download from magento.com. As an example, MageReport does not have an error in the same patch and I've read the document that details their detection method.

EDIT 2018-10-29

The issue eventually disappeared. I believe it was a bug in the scanner that was fixed by Magento.

  • If I'm not mistaken and I remember correctly, the last time I checked there was no "offical" composer setup for Magento 1 - so, what is your source? Side note: I can not verify this issue on an extracted tar ball. Feb 16, 2018 at 18:37
  • I'm using the firegento project to use composer for Magento 1. I've verified that the files are the the same as the tarball but perhaps I should confirm again by creating a little project with both in a subdomain or something. Feb 19, 2018 at 10:17

2 Answers 2


Magento scan tool and Magereport performs the same work but in little different way. I would say Magereport is more flexible than Magento scanner. I'll give you an examples here:

One of my security patch was detected as failed by Magento and on the same time Magereport was saying passed. After investing a lot of effort and time we find out that Magento scanner was getting a 503 error while there was no error when we browse the site. However, when we looked into Network console of the browser we found one of the URL was returning 503 error cause Magento scanner to think that HTTP response if 503 instead of 200.

Conclusion: You may have patched your Magento correctly but due to some other issue Magento may not be able to mark it as pass. Try to connect with Magento support and see if you can hold of someone to figure it out.


Some checks are grey. Can I make them green? MageReport checks from the outside, because it cannot see your code. Sometimes checks will give an "unknown" result. This is notably the case for a fully patched shop, because once patch 5994 is installed, it is not possible to determine the existence of patch 5344. However, as patches must be applied in order, this is seldom a problem.

This is from MageReport when it doesn't detect patches https://www.magereport.com/page/faq#some_checks_are_grey_Can_I_make_them_green

This is the way how Magereport detect SUPEE 8788


  • "... and I've read the document that details their detection method." ... same link?
    – sv3n
    Feb 16, 2018 at 23:52
  • HI @sv3n thanks for this comment, I didn't see details link . it is my bad. thanks for mentioning here. Feb 17, 2018 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.