Description

Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of these details are obtained from third party information.

Remediation

References

CVE-2010-5278

Related Vulnerabilities

OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-2108)

OpenSSL Other Vulnerability (CVE-2015-1790)

WordPress Plugin SEO Plugin LiveOptim Multiple Vulnerabilities (1.1.8-free)

MySQL CVE-2020-14814 Vulnerability (CVE-2020-14814)

WordPress Plugin Insert or Embed Articulate Content into WordPress Directory Traversal (4.2999)

Severity

Medium

Classification

CVE-2010-5278 CWE-22

Tags

Missing Update Known Vulnerabilities