CVEvulnerability
CVE-2017-9067
7.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-05-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.0 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-22
Description
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.
Affected configurations
• modx modx revolution 2.5.6
• php php 5.3.3
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://citadelo.com/en/2017/04/modx-revolution-cms/ Exploit, Third Party Advisory
- https://github.com/modxcms/revolution/pull/13422 Third Party Advisory
- https://github.com/modxcms/revolution/pull/13428 Third Party Advisory
- https://citadelo.com/en/2017/04/modx-revolution-cms/ Exploit, Third Party Advisory
- https://github.com/modxcms/revolution/pull/13422 Third Party Advisory
- https://github.com/modxcms/revolution/pull/13428 Third Party Advisory