CVE-2018-1000207

HIGH7.2EPSS 3.8%

MODX Revolution Incorrect Access Control vulnerability

發布日:2022/5/13修改日:2023/11/8

描述

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

受影響套件(1)

Packagist/modx/revolutionfrom 0, < 2.7.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.2	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-1000207
PATCHhttps://github.com/modxcms/revolution
WEBhttps://github.com/a2u/CVE-2018-1000207
WEBhttps://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68
WEBhttps://github.com/modxcms/revolution/pull/13979
WEBhttps://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4