Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
MODX Revolution 安全漏洞
Vulnerability Description
MODX Revolution是美国MODX公司的一套基于PHP的开源内容管理系统（CMS）。该系统支持在线协作、搜索引擎优化（SEO）、附加组件等。 MODX Revolution 2.5.4-pl及之前的版本中的setup/controllers/language.php文件存在安全漏洞，该漏洞源于程序没有正确的限制‘language’参数。远程攻击者可借助无效的参数值利用该漏洞实施Cookie-Bombing攻击，造成拒绝服务（cookie配额耗尽），或实施HTTP响应拆分攻击。
CVSS Information
N/A
Vulnerability Type
N/A