CVE-2014-2080: XSS
Published Feb 28, 2014
·Updated
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter.
Affected Software
26 affected components
MODx MODX Revolution<=2.2.10
MODx MODX Revolution=2.0.0
MODx MODX Revolution=2.0.1
MODx MODX Revolution=2.0.2
MODx MODX Revolution=2.0.3
MODx MODX Revolution=2.0.4
MODx MODX Revolution=2.0.5
MODx MODX Revolution=2.0.6
MODx MODX Revolution=2.0.7
MODx MODX Revolution=2.0.8
MODx MODX Revolution=2.1.0
MODx MODX Revolution=2.1.1
MODx MODX Revolution=2.1.2
MODx MODX Revolution=2.1.3
MODx MODX Revolution=2.1.4
MODx MODX Revolution=2.1.5
MODx MODX Revolution=2.2.0
MODx MODX Revolution=2.2.1
MODx MODX Revolution=2.2.2
MODx MODX Revolution=2.2.3
MODx MODX Revolution=2.2.4
MODx MODX Revolution=2.2.5
MODx MODX Revolution=2.2.6
MODx MODX Revolution=2.2.7
MODx MODX Revolution=2.2.8
MODx MODX Revolution=2.2.9
Remediation
Event History
Feb 28, 2014
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Mar 1, 2014
Data Sourced
via NVD·12:01 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2080?
CVE-2014-2080 is considered a high severity vulnerability due to its ability to allow remote attackers to execute arbitrary web scripts and HTML.
2
How do I fix CVE-2014-2080?
To fix CVE-2014-2080, upgrade to ModX Revolution version 2.2.11 or later.
3
What software is affected by CVE-2014-2080?
CVE-2014-2080 affects ModX Revolution versions up to and including 2.2.10 and earlier versions 2.0.0 to 2.2.9.
4
What type of vulnerability is CVE-2014-2080?
CVE-2014-2080 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2014-2080 affect my website?
Yes, if your website uses an affected version of ModX Revolution, it is vulnerable to CVE-2014-2080 and could be exploited by attackers.