GHSA-vrw6-7vgj-vj7x

Source

https://github.com/advisories/GHSA-vrw6-7vgj-vj7x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vrw6-7vgj-vj7x

Aliases

CVE-2017-9068

Published

2022-05-17T02:43:14Z

Modified

2025-04-22T19:12:05Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

MODX Revolution Reflected XSS

Details

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-22T18:43:09Z",
    "nvd_published_at":  "2017-05-18T16:29:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / modx/revolution

Package

Name: modx/revolution
Purl: pkg:composer/modx/revolution

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json"