MODX Revolution Incorrect Access Control vulnerability

HIGH 7.2CVE-2018-1000207 · GHSA-m899-6mh4-mpc5 · Published 13/07/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
modx/revolution Packagist	`< 2.7.0`	`2.7.0`
modx revolution modx	`≤ 2.6.4`	No fix yet

Description

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000207 · ADVISORY
modxcms/revolution#13979 · WEB
modxcms/revolution commit 06bc942 · WEB
a2u/CVE-2018-1000207 · WEB
modxcms/revolution · PACKAGE
rudnkh.me/posts/critical-vulnerability-in-modx-revolution-2-6-4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free