Description

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module.

Remediation

References

CVE-2017-11744

Related Vulnerabilities

WordPress Plugin Flo Forms-Easy Drag & Drop Form Builder Multiple Vulnerabilities (1.0.35)

WordPress Plugin RocketTheme RokBox Multiple Vulnerabilities (2.13)

Oracle Application Server CVE-2008-1814 Vulnerability (CVE-2008-1814)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-8958)

Django Memory Allocation with Excessive Size Value Vulnerability (CVE-2026-15337)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2017-11744