PT-2019-11472
CVE-2019-1010123
·
تاريخ النشر
2019-07-23
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions:
MODX Revolution Gallery version 1.7.0
Description:
The issue allows creating a file with custom filename and content. It involves filtering user parameters before passing them into the
phpthumb class. The attack vector is a web request via the "/assets/components/gallery/connector.php" API endpoint.Recommendations:
For MODX Revolution Gallery version 1.7.0, consider restricting access to the
/assets/components/gallery/connector.php API endpoint until a patch is available. As a temporary workaround, filtering user parameters more strictly before passing them into the phpthumb class may help minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾