GitHub Advisoryadvisory · Packagist
GHSA-m899-6mh4-mpc5 MODX Revolution Incorrect Access Control vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2018-1000207
- Ecosystem
- Packagist
- Packages
- modx/revolution
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-732
- Reviewed
- 2023-07-21
Affected packages
• Packagist modx/revolution: < 2.7.0 → fixed in 2.7.0
Description
MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.
Related
Alias · CVE (1)
- CVE-2018-1000207 MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into… vulnerability
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000207 advisory
- https://github.com/modxcms/revolution/pull/13979 web
- https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68 web
- https://github.com/a2u/CVE-2018-1000207 web
- https://github.com/modxcms/revolution package
- https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4 web