CVE-2017-20155 — Sterc Google Analytics Dashboard for MODX Internal Search widget.analytics.tpl cross site scripting

Back Back to CVE browser

MEDIUM

Sterc Google Analytics Dashboard for MODX Internal Search widget.analytics.tpl cross site scripting

Published Dec 30, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.61%

Description

A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal Search. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.6 is able to address this issue. The identifier of the patch is 855d9560d3782c105568eedf9b22a769fbf29cc0. It is recommended to upgrade the affected component. The identifier VDB-217069 was assigned to this vulnerability.

Affected products

Vendor Sterc Product Google Analytics Dashboard for MODX Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  -
- Version
  1.0.1
  Status
  affected
  Constraints
  -
- Version
  1.0.2
  Status
  affected
  Constraints
  -
- Version
  1.0.3
  Status
  affected
  Constraints
  -
- Version
  1.0.4
  Status
  affected
  Constraints
  -
- Version
  1.0.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sterc

Google Analytics Dashboard for MODX

n/a

Version	Status	Constraints
1.0.0	affected	-
1.0.1	affected	-
1.0.2	affected	-
1.0.3	affected	-
1.0.4	affected	-
1.0.5	affected	-

Remediation

No remediation recorded yet.

Metrics

0.61% 0.00607

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00607

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.61% (0.00607)	47.11th	v5 (v2026.06.15)
Jun 15, 2026	0.61% (0.00607)	44.19th	v5 (v2026.06.15)
Mar 17, 2025	0.09% (0.00092)	24.01th	v4 (v2025.03.14)
Dec 12, 2024	0.14% (0.00136)	50.64th	v3 (v2023.03.01)
Jun 11, 2024	0.12% (0.00121)	46.48th	v3 (v2023.03.01)
Apr 5, 2024	0.10% (0.00101)	40.71th	v3 (v2023.03.01)
Feb 1, 2024	0.10% (0.00096)	40.09th	v3 (v2023.03.01)
Jan 6, 2024	0.08% (0.00080)	33.39th	v3 (v2023.03.01)
Nov 30, 2023	0.07% (0.00071)	29.56th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00059)	22.70th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Jan 7, 2023	1.11% (0.01108)	54.24th	v2 (v2022.01.01)
Dec 31, 2022	1.03% (0.01034)	40.70th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://github.com/Sterc/Analytics-dashboard-widget/commit/855d9560d3782c105568eedf9b22a769fbf29cc0
patch
https://github.com/Sterc/Analytics-dashboard-widget/issues/11
issue-trackingExploitIssue TrackingThird Party Advisory
https://github.com/Sterc/Analytics-dashboard-widget/milestone/2
patchProduct
https://github.com/Sterc/Analytics-dashboard-widget/pull/12
issue-trackingPatch
https://vuldb.com/?ctiid.217069
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.217069
vdb-entryThird Party Advisory

Link	Providers	Tags
https://github.com/Sterc/Analytics-dashboard-widget/commit/855d9560d3782c105568eedf9b22a769fbf29cc0		patch
https://github.com/Sterc/Analytics-dashboard-widget/issues/11		issue-trackingExploitIssue TrackingThird Party Advisory
https://github.com/Sterc/Analytics-dashboard-widget/milestone/2		patchProduct
https://github.com/Sterc/Analytics-dashboard-widget/pull/12		issue-trackingPatch
https://vuldb.com/?ctiid.217069		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.217069		vdb-entryThird Party Advisory