CVE-2017-1000223

A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier

published November 17, 2017

CVSS
—
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.7th percentile
Published
2017-11-17T05:00Z
EPSS history
Timeline
  • 17 NOV 05:00Z
    A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier
    cvelistv5