GHSA-m899-6mh4-mpc5

MODX Revolution Incorrect Access Control vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000207

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	modx/revolution	< 2.7.0	2.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000207 advisory
https://github.com/modxcms/revolution/pull/13979 web
https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68 web
https://github.com/a2u/CVE-2018-1000207 web
https://github.com/modxcms/revolution package
https://rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4 web