CVE-2019-1010123: Malicious File Upload
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1010123?
The severity of CVE-2019-1010123 is considered critical due to the potential for unrestricted file uploads.
How do I fix CVE-2019-1010123?
To fix CVE-2019-1010123, update MODX Revolution Gallery to a version later than 1.7.0 that addresses this vulnerability.
What types of files can be uploaded in CVE-2019-1010123?
CVE-2019-1010123 allows attackers to upload files with dangerous types, such as executable scripts, due to inadequate filtering of user input.
What is the attack vector for CVE-2019-1010123?
The attack vector for CVE-2019-1010123 is through web requests made to the /assets/ directory.
Which versions of MODX are affected by CVE-2019-1010123?
CVE-2019-1010123 affects MODX Revolution versions up to and including 2.6.4.