CVE-2017-9067: Path Traversal
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9067?
CVE-2017-9067 is considered a critical vulnerability as it allows attackers to execute arbitrary files on the web server.
How do I fix CVE-2017-9067?
To fix CVE-2017-9067, upgrade MODX Revolution to version 2.5.7 or later and ensure PHP is not at version 5.3.3.
What systems are affected by CVE-2017-9067?
CVE-2017-9067 affects MODX Revolution versions up to 2.5.6 when running on PHP version 5.3.3.
What type of attack can be executed using CVE-2017-9067?
An attacker can perform directory traversal attacks to include and execute arbitrary files on the server.
Is CVE-2017-9067 still a threat if I have updated my software?
If you have updated MODX Revolution to version 2.5.7 or higher and are using a secure PHP version, then CVE-2017-9067 should no longer pose a threat.