medium6.8Public exploit code
CVE-2014-8773
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token o…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
Impact
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Modx | Modx Revolution | Versions 2.0.0, 2.0.1, 2.0.3, 2.0.4, 2.0.5, 2.0.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior
- http://hacktivity.websecgeeks.com/modx-csrf-and-xss/
- http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior
- http://hacktivity.websecgeeks.com/modx-csrf-and-xss/