CVE-2020-25911: XEE

Published Oct 31, 2021

Updated

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

Affected Software

1 affected component

MODx MODX Revolution=2.7.3

Remediation

Patch Available

https://github.com/modxcms/revolution/issues/15237

Event History

Oct 31, 2021

CVE Published

via MITRE·06:32 PM

Data Sourced

via MITRE·06:32 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-25911?

The severity of CVE-2020-25911 is classified as medium due to its potential for information disclosure and denial of service.

How do I fix CVE-2020-25911?

To fix CVE-2020-25911, upgrade to a later version of MODX CMS that addresses the XML External Entity vulnerability.

What causes the CVE-2020-25911 vulnerability?

CVE-2020-25911 is caused by improper handling of XML input in the modRestServiceRequest component of MODX CMS.

What can an attacker achieve with CVE-2020-25911?

An attacker exploiting CVE-2020-25911 can potentially disclose sensitive information or cause denial of service.

Is MODX CMS version 2.7.3 still safe to use after CVE-2020-25911?

MODX CMS version 2.7.3 is not safe to use due to the presence of CVE-2020-25911, and users should upgrade to mitigate the risk.