Lucene search

[email protected]CVE-2008-5845

HistoryJan 05, 2009 - 8:30 p.m.

CVE-2008-5845

2009-01-0520:30:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-5845

cross-site scripting

xss

vulnerabilities

six apart movable type

html injection

web security

5.8 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

56.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template.

CPENameOperatorVersion
sixapart:movable_typesixapart movable typeeq3.15
sixapart:movable_typesixapart movable typeeq3.2
sixapart:movable_typesixapart movable typeeq3.32
sixapart:movable_typesixapart movable typeeq3.16
sixapart:movable_typesixapart movable typeeq3.1
sixapart:movable_typesixapart movable typeeq3.33
sixapart:movable_typesixapart movable typeeq3.14
sixapart:movable_typesixapart movable typeeq3.0d
sixapart:movable_typesixapart movable typeeq3.11
sixapart:movable_typesixapart movable typeeq3.35

CPE	Name	Operator	Version
sixapart:movable_type	sixapart movable type	eq	3.15
sixapart:movable_type	sixapart movable type	eq	3.2
sixapart:movable_type	sixapart movable type	eq	3.32
sixapart:movable_type	sixapart movable type	eq	3.16
sixapart:movable_type	sixapart movable type	eq	3.1
sixapart:movable_type	sixapart movable type	eq	3.33
sixapart:movable_type	sixapart movable type	eq	3.14
sixapart:movable_type	sixapart movable type	eq	3.0d
sixapart:movable_type	sixapart movable type	eq	3.11
sixapart:movable_type	sixapart movable type	eq	3.35

Rows per page:

1-10 of 171

References

jvn.jp/en/jp/JVN45658190/index.html

jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000031.html

www.movabletype.org/mt_423_change_log.html

5.8 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

56.7%

JSON

Related for CVE-2008-5845

cvelist1 jvn1 prion1 ubuntucve1