Description

Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of these details are obtained from third party information.

Remediation

References

CVE-2010-5278

Related Vulnerabilities

Oracle Database Server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2007-2111)

Liferay DXP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-33320)

WordPress 5.5.x Multiple Vulnerabilities (5.5 - 5.5.1)

WordPress Plugin Highlight Search Terms Cross-Site Scripting (1.3)

MySQL CVE-2020-14553 Vulnerability (CVE-2020-14553)

Severity

Medium

Classification

CVE-2010-5278 CWE-22

Tags

Missing Update Known Vulnerabilities