CVE-2020-25911

CRITICAL9.1EPSS 0.96%

XML External Entity vulnerability in MODX CMS

Published: 11/1/2021Modified: 12/6/2023

Also known as:GHSA-vhfp-9wvj-gwvgBIT-modx-2020-25911

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

Affected packages (2)

Bitnami/modx>= 2.7.3, <= 2.7.3
Packagist/modx/revolutionfrom 0, < 2.8.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-25911
PATCHhttps://github.com/modxcms/revolution
WEBhttps://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md
WEBhttps://github.com/modxcms/revolution/issues/15237
WEBhttps://github.com/modxcms/revolution/pull/15238
WEBhttps://github.com/modxcms/revolution/pull/15238/commits/1b7ffe02df30f05dbf67dd15e4d8101687c1585a