PT-2017-12219 · Modx · Modx Revolution

Lemon666 · Published 2017-07-30 · Updated 2017-08-02 · CVE-2017-11744

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MODX Revolution version 2.5.7

Description The issue concerns the System Settings module, where the key and name parameters are susceptible to XSS attacks. When a malicious payload is sent to the "connectors/index.php" endpoint, it will be triggered for every user visiting this module.

Recommendations For MODX Revolution version 2.5.7, consider restricting access to the System Settings module until a fix is available, and avoid using the key and name parameters in the affected module to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-11744

Affected Products

Modx Revolution

References · 4

• https://github.com/modxcms/revolution/issues/13564 · Patch
• https://osv.dev/vulnerability/CVE-2017-11744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11744 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11744 · Note