Description

Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

Remediation

References

CVE-2014-8992

Related Vulnerabilities

Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-10384)

phpMyFAQ Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-15729)

WordPress Plugin JW Player for Flash & HTML5 Video Cross-Site Request Forgery (2.1.3)

Roundcube Files or Directories Accessible to External Parties Vulnerability (CVE-2017-16651)

IBM RTC Improper Restriction of XML External Entity Reference Vulnerability (CVE-2016-9707)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2014-8992