Unscored severity · published Dec 3, 2014
CVE-2014-8775
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain…
–
CVSS
2.8%
EPSS
No
On KEV
Description
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
Modx Revolution · Modx
2.0.0; 2.0.1; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +23 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8775
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8775
forums.modx.com
http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior
Exploit
http://hacktivity.websecgeeks.com/modx-csrf-and-xss/
More from Modx Revolution
9.8
CVE-2017-7324
setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter
9.8
CVE-2017-7321
setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the…
9.1
CVE-2020-25911
A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service…
8.8
CVE-2017-9069
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess
8.1
CVE-2017-7323
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof…