Vulnerability Description
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
CVSS Score
7.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Modx | Revolution | <= 2.8.3 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code
- https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txtExploitThird Party Advisory
- http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code
- https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txtExploitThird Party Advisory
FAQ
What is CVE-2022-26149?
CVE-2022-26149 is a vulnerability with a CVSS score of 7.2 (HIGH). MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an ad...
How severe is CVE-2022-26149?
CVE-2022-26149 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-26149?
Check the references section above for vendor advisories and patch information. Affected products include: Modx Revolution.