Description

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.

Remediation

References

CVE-2016-10038

Related Vulnerabilities

WordPress Plugin xili-tidy-tags Cross-Site Request Forgery (1.12.03)

Oracle Application Server Other Vulnerability (CVE-2007-0285)

PHP Integer Overflow or Wraparound Vulnerability (CVE-2016-5770)

WordPress Plugin YARPP-Yet Another Related Posts PHP Object Injection (4.4)

Java Unspesificed Vulnerability (CVE-2018-3169)

Severity

High

Classification

CVE-2016-10038 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities