| Package | Affected versions | Patched versions |
|---|---|---|
| modx revolution | ≤ 2.5.4 |
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free