GHSA-p2j4-vrgx-96qgMediumCVSS 4.7

MODX Revolution XSS via HTTP Host header

Published
May 17, 2022
Last Modified
April 22, 2025

🔗 CVE IDs covered (1)

CVE-2017-9071 →

📋 Description

In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.

🎯 Affected products1

  • composer/modx/revolution:< 2.5.7

🔗 References (4)