Lucene search

[email protected]CVE-2014-2080

HistoryMar 01, 2014 - 12:01 a.m.

CVE-2014-2080

2014-03-0100:01:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-2080

cross-site scripting

xss

modx revolution

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

75.1%

JSON

Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the “a” parameter.

Affected configurations

NVD

Node

modxmodx_revolutionRange≤2.2.10

modxmodx_revolutionMatch2.0.0

modxmodx_revolutionMatch2.0.1

modxmodx_revolutionMatch2.0.2

modxmodx_revolutionMatch2.0.3

modxmodx_revolutionMatch2.0.4

modxmodx_revolutionMatch2.0.5

modxmodx_revolutionMatch2.0.6

modxmodx_revolutionMatch2.0.7

modxmodx_revolutionMatch2.0.8

modxmodx_revolutionMatch2.1.0

modxmodx_revolutionMatch2.1.1

modxmodx_revolutionMatch2.1.2

modxmodx_revolutionMatch2.1.3

modxmodx_revolutionMatch2.1.4

modxmodx_revolutionMatch2.1.5

modxmodx_revolutionMatch2.2.0

modxmodx_revolutionMatch2.2.1

modxmodx_revolutionMatch2.2.2

modxmodx_revolutionMatch2.2.3

modxmodx_revolutionMatch2.2.4

modxmodx_revolutionMatch2.2.5

modxmodx_revolutionMatch2.2.6

modxmodx_revolutionMatch2.2.7

modxmodx_revolutionMatch2.2.8

modxmodx_revolutionMatch2.2.9

CPENameOperatorVersion
modx:modx_revolutionmodx modx revolutionle2.2.10
modx:modx_revolutionmodx modx revolutioneq2.0.0
modx:modx_revolutionmodx modx revolutioneq2.0.1
modx:modx_revolutionmodx modx revolutioneq2.0.2
modx:modx_revolutionmodx modx revolutioneq2.0.3
modx:modx_revolutionmodx modx revolutioneq2.0.4
modx:modx_revolutionmodx modx revolutioneq2.0.5
modx:modx_revolutionmodx modx revolutioneq2.0.6
modx:modx_revolutionmodx modx revolutioneq2.0.7
modx:modx_revolutionmodx modx revolutioneq2.0.8

CPE	Name	Operator	Version
modx:modx_revolution	modx modx revolution	le	2.2.10
modx:modx_revolution	modx modx revolution	eq	2.0.0
modx:modx_revolution	modx modx revolution	eq	2.0.1
modx:modx_revolution	modx modx revolution	eq	2.0.2
modx:modx_revolution	modx modx revolution	eq	2.0.3
modx:modx_revolution	modx modx revolution	eq	2.0.4
modx:modx_revolution	modx modx revolution	eq	2.0.5
modx:modx_revolution	modx modx revolution	eq	2.0.6
modx:modx_revolution	modx modx revolution	eq	2.0.7
modx:modx_revolution	modx modx revolution	eq	2.0.8

Rows per page:

1-10 of 261

References

modx.com/blog/2014/01/21/revolution-2.2.11%E2%80%94security-fixes-and-prevent-change-loss

seclists.org/oss-sec/2014/q1/431

secunia.com/advisories/57038

www.securityfocus.com/bid/65755

github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

75.1%

JSON

Related for CVE-2014-2080

cvelist2 prion2 nvd2 cve1