medium5.0Public exploit code
CVE-2014-8775
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
Impact
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Modx | Modx Revolution | Versions 2.0.0, 2.0.1, 2.0.3, 2.0.4, 2.0.5, 2.0.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior
- http://hacktivity.websecgeeks.com/modx-csrf-and-xss/
- http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior
- http://hacktivity.websecgeeks.com/modx-csrf-and-xss/