XML External Entity vulnerability in MODX CMS

CRÍTICO 9.1CVE-2020-25911 · BIT-modx-2020-25911 · GHSA-vhfp-9wvj-gwvg · Published 31/10/2021 · updated 17/06/2026

Em resumo

CVE-2020-25911 é uma vulnerabilidade CRÍTICO (CVSS 9.1) que afeta modx/revolution, modx revolution (modx).
Chance de exploração nos próximos 30 dias (EPSS): 2.4%, maior que 83.9% das vulnerabilidades.
Correção: atualize para 2.8.0 ou posterior.

Package	Affected versions	Patched versions
modx/revolution Packagist	`< 2.8.0`	`2.8.0`
modx revolution modx	`= 2.7.3`	No fix yet

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

NVD description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

References

nvd.nist.gov/vuln/detail/CVE-2020-25911 · ADVISORY
modxcms/revolution · WEB
modxcms/revolution#15238 · WEB
modxcms/revolution#15238 · WEB
dahua966/Vul_disclose · WEB
modxcms/revolution · PACKAGE

Mais vulnerabilidades de modx/revolution

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

modx/revolution

Packagist

< 2.8.0

2.8.0

modx revolution

modx

= 2.7.3

No fix yet

Description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

NVD description

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

Mais vulnerabilidades de modx/revolution

Ver tudo →