Security readout for executives and security teams
Plain-English summary
CVE-2017-9071 is an XSS risk in MODX Revolution versions before 2.5.7. A crafted HTTP Host header may affect generated content, but the CVE says exploitation depends on another weakness such as cache poisoning. Treat exposed older MODX sites as upgrade candidates, not as confirmed actively exploited systems.
Executive priority
Prioritize this for legacy or public MODX sites, especially where caching infrastructure is present. It is not supported as an emergency active-exploitation item by the provided sources, but it should be closed during normal vulnerability remediation.
Technical view
The issue concerns MODX Revolution before 2.5.7 handling of the HTTP Host header. An attacker might inject script content through that header, with practical exploitability tied to cache poisoning or similar supporting flaws. The source bundle provides no CVSS, CWE, or detailed affected CPE data.
Likely exposure
Exposure is most likely on internet-facing MODX Revolution installations older than 2.5.7, especially where reverse proxies, CDN caches, or application caches can store responses influenced by untrusted Host headers.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not state active exploitation. The description explicitly limits exploitability to situations involving other issues, such as cache poisoning.
Researcher notes
The useful boundary is prerequisite validation: determine whether Host-derived content can enter cached responses. The CVE data is sparse, with no CVSS, CWE, or CPEs, so version confirmation and architecture review matter more than scanner labels alone.
Mitigation direction
- Upgrade MODX Revolution instances older than 2.5.7.
- Review MODX vendor guidance and the referenced fix before relying on compensating controls.
- Restrict accepted Host headers to approved site domains at the proxy or application layer.
- Review CDN and cache behavior for Host-header-influenced cached content.
- Purge potentially poisoned application, proxy, and CDN caches after remediation.
Validation and detection
- Inventory MODX Revolution versions and identify any instance below 2.5.7.
- Confirm public routes reject or normalize unapproved Host headers.
- Review cache configuration for keys and variants involving hostnames.
- Check web logs for unusual Host header values targeting MODX sites.
- Verify remediation in staging before production rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9071 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://citadelo.com/en/2017/04/modx-revolution-cms/CVE reference · x_refsource_MISC
- https://github.com/modxcms/revolution/pull/13426CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.