citadelo.com
https://citadelo.com/en/2017/04/modx-revolution-cms CVE-2017-9071
MEDIUM
MODX Revolution XSS via HTTP Host header
Record summary
CVE-2017-9071 has a selected CVSS score of 4.7 (medium).
Description
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
modx/revolutionBrowse Packagist / modx/revolution | GitHub Advisory | Before 2.5.7 · Fixed in 2.5.7 | affected |
References
4github.com
https://github.com/modxcms/revolution github.com
https://github.com/modxcms/revolution/pull/13426 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-9071