CVE-2017-7323

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier

Description The issue concerns the update and package-installation features, which use http://rest.modx.com by default. This allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code by leveraging the lack of the HTTPS protection mechanism.

Recommendations For MODX Revolution versions 2.5.4-pl and earlier, consider updating the default URL to use HTTPS instead of HTTP to protect against man-in-the-middle attacks. As a temporary workaround, restrict access to the update and package-installation features until a secure connection can be established.