CVE-2017-7322

2017-03-3007:59:00

Google

osv.dev

7.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.8%

JSON

The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.

CPENameOperatorVersion
revolutioneq2.5.4-pl
revolutioneq2.5.3-pl
revolutioneq2.1.4-pl
revolutioneq2.3.6-pl
revolutioneq2.5.2-pl
revolutioneq2.2.9-pl
revolutioneq2.2.0-pl2
revolutioneq2.4.0-rc1
revolutioneq2.1.3-pl
revolutioneq2.0.4-pl

Name	Operator	Version
revolution	eq	2.5.4-pl
revolution	eq	2.5.3-pl
revolution	eq	2.1.4-pl
revolution	eq	2.3.6-pl
revolution	eq	2.5.2-pl
revolution	eq	2.2.9-pl
revolution	eq	2.2.0-pl2
revolution	eq	2.4.0-rc1
revolution	eq	2.1.3-pl
revolution	eq	2.0.4-pl