CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.4. It affects Java. Exploitation may require the attacker to be authenticated.
CVE
CVE-2017-1000223
Severity
MEDIUM
CVSS
5.4
EPSS
0.50%
Java
Original NVD Description
A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.
Related CVEs
Other vulnerabilities affecting the same vendor(s)