GHSA-vhfp-9wvj-gwvg

XML External Entity vulnerability in MODX CMS

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-25911

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	modx/revolution	< 2.8.0	2.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-25911 advisory
https://github.com/modxcms/revolution/issues/15237 web
https://github.com/modxcms/revolution/pull/15238 web
https://github.com/modxcms/revolution/pull/15238/commits/1b7ffe02df30f05dbf67dd15e4d8101687c1585a web
https://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md web
https://github.com/modxcms/revolution package