CVE-2017-7323

Опубликовано: 30 мар. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code by leveraging the lack of the HTTPS protection mechanism.

Ссылки

http://www.securityfocus.com/bid/97228
Third Party Advisory
VDB Entry
https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf
Exploit
Technical Description
Third Party Advisory
http://www.securityfocus.com/bid/97228
Third Party Advisory
VDB Entry
https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf
Exploit
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:modx:modx_revolution:*:*:*:*:*:*:*:*

Версия до 2.5.4 (включая)

EPSS

Процентиль: 78%

0.01126

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-8vff-g827-6gg8