What is GHSA-m899-6mh4-mpc5?

GHSA-m899-6mh4-mpc5 is a security advisory published by GitHub Security Advisories with High severity. MODX Revolution Incorrect Access Control vulnerability

Which CVE IDs does GHSA-m899-6mh4-mpc5 cover?

GHSA-m899-6mh4-mpc5 covers the following CVE IDs: CVE-2018-1000207. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m899-6mh4-mpc5?

GHSA-m899-6mh4-mpc5 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-m899-6mh4-mpc5?

GHSA-m899-6mh4-mpc5 affects 1 product, including: composer/modx/revolution:\u003c= 2.6.4.

GHSA-m899-6mh4-mpc5HighCVSS 7.2

MODX Revolution Incorrect Access Control vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

October 6, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000207 →

📋 Description

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

🎯 Affected products1

composer/modx/revolution:<= 2.6.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000207
https://github.com/modxcms/revolution/pull/13979
https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68
https://github.com/a2u/CVE-2018-1000207
https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4
https://github.com/advisories/GHSA-m899-6mh4-mpc5