XXE Vulnerability

[dahua966]

snipped

[Mark-H]

The email is security@modx.com. I'm not sure about that form (will get that checked), but publicly posting vulnerability details rather than asking somewhere on how to privately disclose if the first avenue doesn't work is... a little disappointing.

[Mark-H]

The security report form seems to work as expected, test email sent and arrived.

[Ruslan-Aleev]

It seems to me that @dahua966 is talking about the page that is listed in the template for "Report a security vulnerability" on github. There is a page listed - https://modx.com/community/contribute/report-a-security-issue and it doesn't work.

[Mark-H]

@jaygilmore / @rthrash can you get the old URL https://modx.com/community/contribute/report-a-security-issue to redirect to the new form at https://modx.com/about/security-reports?

@Ruslan-Aleev Where are you seeing that URL on? I'm only seeing a reference to security@modx.com in the CONTRIBUTING.md.

[Ruslan-Aleev]

@Mark-H In the file https://github.com/modxcms/revolution/security/policy, you can go to it when creating a security issue.

[Mark-H]

Ah, there it is. Fixed, thanks.

[Mark-H]

Fixed in #15238 - @dahua966 if you want to take a look at that and confirm it resolves it that would be appreciated.