Path traversal in MODX Revolution and PHP - CVE-2017-9067

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU38971

Path traversal in MODX Revolution and PHP - CVE-2017-9067

Published: May 18, 2017 / Updated: August 8, 2020


Vulnerability identifier: #VU38971
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-9067
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local authenticated user to execute arbitrary code.

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.


Affected software

MODX Revolution
PHP

How to mitigate CVE-2017-9067

Install update from vendor's website.


External References

Related Security Bulletins