CVE-2015-1592

🗓️ 19 Feb 2015 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 80 Views🌐 WEB

Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 allows remote attackers to execute arbitrary code

Reporter	Title	Published	Views	Family All 21
0day.today	SixApart MovableType Storable Perl Code Execution Exploit	15 May 201500:00	–	zdt
Circl	CVE-2015-1592	11 Feb 201500:00	–	circl
CNVD	Unspecified Local File Containment Vulnerability in Movable Type	21 Feb 201500:00	–	cnvd
Check Point Advisories	SixApart MovableType Storable Perl Code Execution (CVE-2015-1592)	26 Sep 201600:00	–	checkpoint_advisories
Cvelist	CVE-2015-1592	19 Feb 201515:00	–	cvelist
Debian	[SECURITY] [DSA 3183-1] movabletype-opensource security update	12 Mar 201515:22	–	debian
Debian	[SECURITY] [DSA 3183-1] movabletype-opensource security update	12 Mar 201515:22	–	debian
Tenable Nessus	Debian DSA-3183-1 : movabletype-opensource - security update	13 Mar 201500:00	–	nessus
Exploit DB	SixApart MovableType - Storable Perl Code Execution (Metasploit)	12 May 201500:00	–	exploitdb
Exploit DB	SixApart MovableType < 5.2.12 - Storable Perl Code Execution (Metasploit)	11 Feb 201500:00	–	exploitdb

NVD

Node

Node

sixapart movable_typeRange5.2.0–5.2.12advanced

sixapart movable_typeRange5.2.0–5.2.12open_source

sixapart movable_typeRange5.2.0–5.2.12pro

sixapart movable_typeRange6.0–6.0.7advanced

Source	Link
openwall	www.openwall.com/lists/oss-security/2015/02/12/17
debian	www.debian.org/security/2015/dsa-3183
securitytracker	www.securitytracker.com/id/1031777
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/100912
movabletype	www.movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html
openwall	www.openwall.com/lists/oss-security/2015/02/12/2
securityfocus	www.securityfocus.com/bid/72606

Parameter	Position	Path	Description	CWE
__mode	query param	/cgi-bin/mt/mt-wizard.cgi	Deserialization-based RCE via MovableType mt-wizard.cgi using Storable thunk/freeze parameters.	CWE-74
step	query param	/cgi-bin/mt/mt-wizard.cgi	Deserialization-based RCE via MovableType mt-wizard.cgi using Storable thunk/freeze parameters.	CWE-74
config	query param	/cgi-bin/mt/mt-wizard.cgi	Deserialization-based RCE via MovableType mt-wizard.cgi using Storable thunk/freeze parameters.	CWE-74
xyzzy	query param	/cgi-bin/mt/mt.cgi	RCE payload delivered through mt.cgi with the 'xyzzy' parameter containing Storable-serialized data.	CWE-74

17 Jun 2026 00:22Current

7.5High risk

Vulners AI Score7.5

CVSS 27.5

EPSS0.75029