CVE-2017-9071: XSS
Published May 18, 2017
·Updated
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.
Affected Software
2 affected componentsFixes available
MODx MODX Revolution<=2.5.6
composer/modx/revolution<2.5.7
2.5.7
Remediation
Patch Available
Patch Available
Event History
May 18, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·02:43 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-9071?
CVE-2017-9071 has been classified as a medium severity vulnerability due to its potential for exploitation via XSS.
2
How do I fix CVE-2017-9071?
To mitigate CVE-2017-9071, upgrade to MODX Revolution version 2.5.7 or later.
3
What kind of attack can CVE-2017-9071 enable?
CVE-2017-9071 can enable attackers to perform Cross-Site Scripting (XSS) attacks through crafted HTTP Host header injections.
4
Which versions of MODX Revolution are affected by CVE-2017-9071?
CVE-2017-9071 affects all versions of MODX Revolution prior to version 2.5.7.
5
Is CVE-2017-9071 exploitable on its own?
CVE-2017-9071 is not directly exploitable on its own and requires additional vulnerabilities, such as Cache Poisoning, to be effective.