GHSA-p2j4-vrgx-96qg

ghsaUSosv

MODX Revolution XSS via HTTP Host header

view advisory published 2022-05-17Licence: CC-BY-4.0

In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-9071US	medium4.7	0.65% (51st)	—	2017-05-18
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction wit…

references

External citations — patches, advisories, analysis.

https://citadelo.com/en/2017/04/modx-revolution-cmsWEB
https://github.com/modxcms/revolutionPACKAGE
https://github.com/modxcms/revolution/pull/13426WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-9071ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan