JVN#20083397: Movable Type vulnerable to session hijacking

Movable Type contains a session hijacking vulnerability in entering comments and community functionality.

Impact

A remote unauthenticated attacker may impersonate an honest user of the affected product.

Solution

Update the software
Update to the latest version of each product according to the information provided by the developer.

Products Affected

Version 5.12, 5.06, 4.37, 4.292 and earlier of the products listed below are vulnerable.

• Movable Type Open Source
• Movable Type (with Professional Pack, Community Pack)
• Movable Type Enterprise
• Movable Type Advanced
  For more information, refer to the information provided by the developer.