CVE-2017-9068: MODX Revolution Reflected XSS Vulnerability
Summary
CVE-2017-9068: MODX Revolution Reflected XSS. Affects modx/revolution versions < 2.5.7. Fixed in 2.5.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MODX Revolution is an open-source content management system (CMS) that allows users to create and manage websites with ease. It offers a flexible architecture, enabling developers to customize and extend its functionality. However, prior to version 2.5.7, MODX Revolution was susceptible to a reflected cross-site scripting (XSS) vulnerability, which could be exploited through various fields on the setup page.
Vulnerability Detail
In MODX Revolution versions before 2.5.7, an attacker can exploit a reflected XSS vulnerability by injecting malicious payloads into certain fields, such as the 'database_type' parameter on the setup page. This vulnerability allows attackers to execute arbitrary scripts in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious actions. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
2.5.7
This is the first release that contains the fix.
composer require modx/revolution:2.5.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to validate and sanitize user inputs on the setup page to prevent the execution of malicious scripts. However, the best solution is to update to the latest version of MODX Revolution.
Conclusion
The reflected XSS vulnerability in MODX Revolution prior to version 2.5.7 poses a significant risk to users and their data. It is crucial to update to the latest version to mitigate this risk and ensure the security of your web applications.
See every vulnerability recorded for modx/revolution →
FAQ
Reflected XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then executed in the user's browser when they click on a specially crafted link.
If you are using a version of MODX Revolution prior to 2.5.7, your installation is vulnerable to this reflected XSS issue. You can check your version in the admin panel or by inspecting the composer.lock file.
Exploitation of this vulnerability can lead to unauthorized access to user sessions, data theft, and the ability to perform actions on behalf of the user without their consent.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software. You can use the Vulert playground to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk associated with its exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for modx/revolution.
