Design/Logic Flaw

2019-07-2313:15:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.0%

JSON

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php.

CPENameOperatorVersion
modx_revolutionle2.6.4

CPE	Name	Operator	Version
	modx_revolution	le	2.6.4

References

modx.pro/security/15912

modx.today/posts/2018/07/critical-security-vulnerability-in-gallery-1.7.1