CRITICAL9.1

GHSA-vhfp-9wvj-gwvg

XML External Entity vulnerability in MODX CMS

Quick fix

GHSA-vhfp-9wvj-gwvg — modx/revolution: upgrade to the fixed version with the command below.

composer require modx/revolution:^2.8.0

Details

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/modx/revolution

Introduced in: 0Fixed in: 2.8.0

Fixcomposer require modx/revolution:^2.8.0

References

https://nvd.nist.gov/vuln/detail/CVE-2020-25911[ADVISORY]
https://github.com/modxcms/revolution/issues/15237[WEB]
https://github.com/modxcms/revolution/pull/15238[WEB]
https://github.com/modxcms/revolution/pull/15238/commits/1b7ffe02df30f05dbf67dd15e4d8101687c1585a[WEB]
https://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md[WEB]
https://github.com/modxcms/revolution[PACKAGE]