GHSA-cgrv-6h2h-6f7v

ghsaUSosv

MODX Revolution Directory Traversal Vulnerability

view advisory published 2022-05-17Licence: CC-BY-4.0

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-9067US	high7.0	0.82% (57th)	—	2017-05-18
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action p…

references

External citations — patches, advisories, analysis.

https://citadelo.com/en/2017/04/modx-revolution-cmsWEB
https://github.com/modxcms/revolutionPACKAGE
https://github.com/modxcms/revolution/pull/13422WEB
https://github.com/modxcms/revolution/pull/13428WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-9067ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan