high7.2
CVE-2018-1000207
MODX Revolution Incorrect Access Control vulnerability
Impact
MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | modx/revolution | <= 2.6.4 | 2.7.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Modx | Modx Revolution | through 2.6.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/a2u/CVE-2018-1000207
- https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68
- https://github.com/modxcms/revolution/pull/13979
- https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4
- https://github.com/advisories/GHSA-m899-6mh4-mpc5
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000207