GitHub Advisoryadvisory · Packagist

GHSA-vrw6-7vgj-vj7x MODX Revolution Reflected XSS

MEDIUM Published 2022-05-17 Modified 2025-04-22 Official page ↗
Aliases
CVE-2017-9068
Ecosystem
Packagist
Packages
modx/revolution
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-04-22

Affected packages

• Packagist modx/revolution: < 2.5.7 → fixed in 2.5.7

Description

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.

Related

Alias · CVE (1)

  • CVE-2017-9068 In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References