GitHub Advisoryadvisory · Packagist

GHSA-j8jp-9x42-4pj5 Unrestricted Upload of File with Dangerous Type in MODX Revolution

HIGH Published 2022-02-27 Modified 2022-03-11 Official page ↗
Aliases
CVE-2022-26149
Ecosystem
Packagist
Packages
modx/revolution
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2022-03-11

Affected packages

• Packagist modx/revolution: <= 2.8.3-pl (no fix yet)

Description

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

Related

Alias · CVE (1)

  • CVE-2022-26149 MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file,… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References