Security readout for executives and security teams
Plain-English summary
MODX Revolution through 2.7.0-pl is reported to allow cross-site scripting through the User Photo field. This could let malicious content run in a browser when vulnerable profile data is viewed. The provided sources do not include CVSS, a CWE, confirmed exploitation, or a named fixed release.
Executive priority
Prioritize inventory and vendor-guidance review if MODX is used for public or business-critical sites. Urgency is constrained by missing severity and exploitation evidence, but XSS in a CMS can affect trust and account security.
Technical view
The CVE describes an XSS issue in MODX Revolution through v2.7.0-pl via the User Photo field. The available bundle identifies one upstream GitHub issue reference but does not provide exploit status, patch details, or scoring metadata. Treat affected profile/user-management data as untrusted until vendor guidance is confirmed.
Likely exposure
Exposure is likely limited to organizations running MODX Revolution at or below v2.7.0-pl and using user profile functionality where the User Photo field can be set or displayed.
Exploitation context
No active exploitation is supported by the provided sources, and the CVE is not listed as KEV. The source bundle only supports that XSS is possible through the User Photo field.
Researcher notes
The evidence is sparse: description, version ceiling, field vector, and one GitHub issue. No CVSS vector, CWE, proof of exploitation, affected CPEs, or fixed version is included in the bundle.
Mitigation direction
- Identify MODX Revolution instances and versions in your environment.
- Check MODX project guidance and issue 14102 for remediation details.
- Restrict profile and user-management changes to trusted users until remediated.
- Review existing User Photo values as untrusted content.
- Apply an available vendor-supported update after change testing.
Validation and detection
- Confirm whether any MODX instance is at or below v2.7.0-pl.
- Review user profile records for suspicious User Photo values without rendering them.
- Check administrative logs for recent User Photo changes.
- Verify vendor guidance before declaring remediation complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-20755 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/modxcms/revolution/issues/14102CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.