GitHub Advisoryadvisory · Packagist

GHSA-vhfp-9wvj-gwvg XML External Entity vulnerability in MODX CMS

CRITICAL Published 2021-11-01 Modified 2021-11-03 Official page ↗
Aliases
CVE-2020-25911
Ecosystem
Packagist
Packages
modx/revolution
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-611
Reviewed
2021-11-01

Affected packages

• Packagist modx/revolution: < 2.8.0 → fixed in 2.8.0

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

Related

Alias · CVE (1)

  • CVE-2020-25911 A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References