CVE-2017-1000223 - A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier

Back Back to CVE browser

MEDIUM

A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier

Published Nov 17, 2017

5.4

MEDIUM

CVSS 3.0

EPSS 0.50%

Description

A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1492
Advisory
https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog.txt
x_refsource_MISCRelease NotesThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1492		Advisory
https://raw.githubusercontent.com/modxcms/revolution/v2.5.7-pl/core/docs/changelog.txt		x_refsource_MISCRelease NotesThird Party Advisory