cbcvebase.
CVE-2017-1000223
published 2017-11-17

CVE-2017-1000223: A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with…

PriorityP424medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.50%
38.9th percentile
A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.

Affected

4 ranges
VendorProductVersion rangeFixed in
modxmodx_revolution<= 2.5.6
surinasoundtouch>= 0 < 1.7.1-5ubuntu0.1~esm11.7.1-5ubuntu0.1~esm1
surinasoundtouch>= 0 < 1.9.2-2+deb9u1ubuntu0.1~esm11.9.2-2+deb9u1ubuntu0.1~esm1
surinasoundtouch>= 0 < 1.9.2-3ubuntu0.1~esm11.9.2-3ubuntu0.1~esm1

CVSS provenance

nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.