HIGH🇵🇱 Wersja polska

CVE-2022-26149

CVSS 7.2v3.1pub. 2022-02-26upd. 2024-11-21

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Modx Revolution

    APP
    Modx
    ≤ 2.8.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2017-1000067HIGH8.8same product

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by th...

CVE-2010-4883LOW2.6same product

Podatność XSS w pliku manager/index.php w MODx Revolution 2.0.2-pl pozwala zdalnym atakującym na iniekcję dowo...

CVE-2020-25911CRITICAL9.1PL ✓same vendor

XXE w MODX CMS — ujawnienie informacji lub atak DoS

CVE-2019-1010178CRITICAL9.8PL ✓same vendor

RCE w Fred MODX Revolution — nieprawidłowa kontrola dostępu w elFinder

CVE-2017-7324CRITICAL9.8PL ✓same vendor

RCE w MODX Revolution — wykonanie kodu PHP przez setup/templates/findcore.php