Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
MODX Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2017-1000223 - Vulnerability Database
MODX

MODX Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2017-1000223

Medium
Reference: CVE-2017-1000223
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2017-1000223
Title: MODX Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

A stored web content injection vulnerability (WCI a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims39 accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.