CVE-2020-25911

CRITICAL9.1EPSS 0.96%

XML External Entity vulnerability in MODX CMS

發布日:2021/11/1修改日:2023/12/6

也稱為:GHSA-vhfp-9wvj-gwvgBIT-modx-2020-25911

描述

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

受影響套件(2)

Bitnami/modx>= 2.7.3, <= 2.7.3
Packagist/modx/revolutionfrom 0, < 2.8.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-25911
PATCHhttps://github.com/modxcms/revolution
WEBhttps://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md
WEBhttps://github.com/modxcms/revolution/issues/15237
WEBhttps://github.com/modxcms/revolution/pull/15238
WEBhttps://github.com/modxcms/revolution/pull/15238/commits/1b7ffe02df30f05dbf67dd15e4d8101687c1585a