Well spotted ;) That releases fixes all issues we're aware off. A quick announcement is going out shortly, a full announcement with more details on what has been fixed will be going out tomorrow or the next few days.
As you can probably imagine, this is a critical update everyone should install as soon as possible. Please let us know at github.com/modxcms/revolution/issues if there are any new bugs, or security@modx.com for new security issues.
///---///
I'm thankful to everyone that contributed into getting these vulnerabilities fixed. If the official announcement should get another name added that we missed, please let me know and I'll try to get someone to update that.
///---///
Yes, that's one of the xPDO fixes. Developers should still make sure user input is sanitised though.
Как вы, вероятно, может себе представить, что это критическое обновление каждый должен установить как можно скорее. Пожалуйста, дайте нам знать, если github.com/modxcms/revolution/issues есть какие-либо новые ошибки, или security@modx.com новых вопросов безопасности.
/// — ///
Well spotted ;) That releases fixes all issues we're aware off. A quick announcement is going out shortly, a full announcement with more details on what has been fixed will be going out tomorrow or the next few days.
As you can probably imagine, this is a critical update everyone should install as soon as possible. Please let us know at github.com/modxcms/revolution/issues if there are any new bugs, or security@modx.com for new security issues.
— I understand you know about the different vulnerabilities. We've fixed a few now. Could you please email security@modx.com with your information so we can be sure MODX is secure again? Thank you!
I am part of the security team and core integrators on the MODX project though. So if anyone from the Russian-speaking community would like to discuss project related things with me, I am more than happy to work with them.
We took too long to respond to your initial email, and I'm sorry for that. Maybe we need to set up new policies on who handles reports in what way to make sure that doesn't happen, but talking to Ryan is not the same as alerting core developers about critical issues.
It's good that steps to hack a site are not posted publicly, but we do need that information via security@modx.com so we can fix it as soon as possible. If it's in Russian we can use google translate, as long as we get the information we need to solve it.
Earlier today Jason got information that made it clear there are serious vulnerabilities and he has been working on fixing them since, and as member of the security team he asked me to help as well. Thanks to help from people like Nikolay and Bezumkin we've found and fixed some issues, but we still don't have all the information about how some of the things discussed in the comments work. So please, if you have any details or proof of concepts of attacks, please email those to security@modx.com so we can make MODX safer and release an update soon.