Vulnerability Description
Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of these details are obtained from third party information.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Modx | Modx Revolution | <= 2.0.2 |
Related Weaknesses (CWE)
References
- http://modxcms.com/forums/index.php/topic%2C55104.0.html
- http://modxcms.com/forums/index.php/topic%2C55105.msg317273.html
- http://packetstormsecurity.org/1009-exploits/modx202pl-lfi.txtThird Party Advisory
- http://secunia.com/advisories/41638Vendor Advisory
- http://www.johnleitch.net/Vulnerabilities/MODx.Revolution.2.0.2-pl.Local.File.InThird Party Advisory
- http://www.osvdb.org/68265Broken Link
- http://www.securityfocus.com/bid/43577Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62073Third Party AdvisoryVDB Entry
- http://modxcms.com/forums/index.php/topic%2C55104.0.html
- http://modxcms.com/forums/index.php/topic%2C55105.msg317273.html
- http://packetstormsecurity.org/1009-exploits/modx202pl-lfi.txtThird Party Advisory
- http://secunia.com/advisories/41638Vendor Advisory
- http://www.johnleitch.net/Vulnerabilities/MODx.Revolution.2.0.2-pl.Local.File.InThird Party Advisory
- http://www.osvdb.org/68265Broken Link
- http://www.securityfocus.com/bid/43577Third Party AdvisoryVDB Entry
FAQ
What is CVE-2010-5278?
CVE-2010-5278 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read ...
How severe is CVE-2010-5278?
CVE-2010-5278 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-5278?
Check the references section above for vendor advisories and patch information. Affected products include: Modx Modx Revolution.