XML External Entity vulnerability in MODX CMS

KRITISCH 9.1CVE-2020-25911 · BIT-modx-2020-25911 · GHSA-vhfp-9wvj-gwvg · Published 31/10/2021 · updated 17/06/2026

Kurz gesagt

CVE-2020-25911 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in modx/revolution, modx revolution (modx).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.4%, höher als bei 83.9% aller Schwachstellen.
Abhilfe: auf 2.8.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
modx/revolution Packagist	`< 2.8.0`	`2.8.0`
modx revolution modx	`= 2.7.3`	No fix yet

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

NVD description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

References

nvd.nist.gov/vuln/detail/CVE-2020-25911 · ADVISORY
modxcms/revolution · WEB
modxcms/revolution#15238 · WEB
modxcms/revolution#15238 · WEB
dahua966/Vul_disclose · WEB
modxcms/revolution · PACKAGE

Weitere Schwachstellen in modx/revolution

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

modx/revolution

Packagist

< 2.8.0

2.8.0

modx revolution

modx

= 2.7.3

No fix yet

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

NVD description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

Weitere Schwachstellen in modx/revolution

Alle anzeigen →