CVE-2018-1000207: High severity modx revolution vulnerability

Q: What is the severity of CVE-2018-1000207?

CVE-2018-1000207 is classified as a medium severity vulnerability due to its potential to create files with custom content.

Q: How do I fix CVE-2018-1000207?

To mitigate CVE-2018-1000207, upgrade your MODX Revolution version to 2.6.5 or later.

Q: What causes CVE-2018-1000207?

CVE-2018-1000207 is caused by incorrect access control in the filtering of user parameters within the phpthumb class.

Q: Who is affected by CVE-2018-1000207?

CVE-2018-1000207 affects all versions of MODX Revolution up to and including 2.6.4.

Q: Can CVE-2018-1000207 be exploited remotely?

Yes, CVE-2018-1000207 can be exploited via web requests, making it a remote code execution vulnerability.

Published Jul 13, 2018

Updated

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

Affected Software

2 affected componentsFixes available

composer/modx/revolution<=2.6.4

2.7.0

MODx MODX Revolution<=2.6.4

Remediation

Patch Available

https://github.com/modxcms/revolution/commit/06bc94257408f6a575de20ddb955aca505ef6e68

Event History

Jul 13, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

May 13, 2022

Advisory Published

01:48 AM

Frequently Asked Questions

What is the severity of CVE-2018-1000207?

CVE-2018-1000207 is classified as a medium severity vulnerability due to its potential to create files with custom content.

How do I fix CVE-2018-1000207?