citadelo.com
https://citadelo.com/en/2017/04/modx-revolution-cms CVE-2017-9070
MEDIUM
MODX Revolution cross-site scripting vulnerability
Record summary
CVE-2017-9070 has a selected CVSS score of 5.4 (medium).
Description
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
modx/revolutionBrowse Packagist / modx/revolution | GitHub Advisory | Before 2.5.7 · Fixed in 2.5.7 | affected |
References
4github.com
https://github.com/modxcms/revolution github.com
https://github.com/modxcms/revolution/pull/13415 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-9070