CVE-2017-7320: XSS
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7320?
The severity of CVE-2017-7320 is considered to be medium, primarily due to its potential to enable denial-of-service attacks or HTTP response splitting.
How do I fix CVE-2017-7320?
To fix CVE-2017-7320, upgrade to MODX Revolution version 2.5.5 or later, which addresses the vulnerability.
What types of attacks can CVE-2017-7320 facilitate?
CVE-2017-7320 can facilitate Cookie-Bombing attacks leading to denial of service and HTTP Response Splitting attacks.
Is CVE-2017-7320 present in all versions of MODX Revolution?
CVE-2017-7320 affects MODX Revolution version 2.5.4-pl and earlier versions.
What impact does CVE-2017-7320 have on web applications?
The impact of CVE-2017-7320 on web applications includes potential cookie quota exhaustion and vulnerabilities to response splitting.