CVE-2017-7320

setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to…

published March 30, 2017

CVSS
—
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00869 · 58.1th percentile
Published
2017-03-30T07:00Z
EPSS history
Timeline
  • 30 MAR 07:00Z
    setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to…
    cvelistv5