CVE-2014-8992: XSS

Published Dec 22, 2014

Updated

Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

Affected Software

1 affected component

MODx MODX Revolution=2.3.2

Event History

Dec 22, 2014

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8992?

CVE-2014-8992 is considered a critical severity vulnerability due to its potential to allow remote code execution via cross-site scripting.

How do I fix CVE-2014-8992?

To fix CVE-2014-8992, you should upgrade MODX Revolution to a version later than 2.3.2 that addresses this XSS vulnerability.

What is the nature of the attack for CVE-2014-8992?

CVE-2014-8992 allows attackers to inject arbitrary web script or HTML into the application through the callback parameter.

Which versions of MODX Revolution are affected by CVE-2014-8992?

Only MODX Revolution version 2.3.2 is affected by CVE-2014-8992.

Can CVE-2014-8992 lead to data theft?

Yes, CVE-2014-8992 can potentially lead to data theft if an attacker successfully executes malicious scripts.