CVE-2017-7324

Опубликовано: 30 мар. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.

Ссылки

http://www.securityfocus.com/bid/97228
Third Party Advisory
VDB Entry
https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf
Exploit
Technical Description
Third Party Advisory
http://www.securityfocus.com/bid/97228
Third Party Advisory
VDB Entry
https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdf
Exploit
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:modx:modx_revolution:*:*:*:*:*:*:*:*

Версия до 2.5.4 (включая)

EPSS

Процентиль: 84%

0.02182

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-w945-rw52-mrwp