CVE-2014-5451: XSS
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5451?
CVE-2014-5451 has been rated as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2014-5451?
To fix CVE-2014-5451, upgrade to MODX Revolution version 2.3.2 or later.
What types of attacks can be performed due to CVE-2014-5451?
CVE-2014-5451 allows attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.
Which versions of MODX Revolution are affected by CVE-2014-5451?
CVE-2014-5451 affects MODX Revolution version 2.3.1-pl and earlier versions.
Is there a known workaround for CVE-2014-5451?
There are no known workarounds for CVE-2014-5451; patching the software is the recommended solution.