Lucene search

Japan Vulnerability NotesJVN:39139884

HistoryOct 25, 2023 - 12:00 a.m.

JVN#39139884: Movable Type vulnerable to cross-site scripting

2023-10-2500:00:00

Japan Vulnerability Notes

jvn.jp

movable type

cross-site scripting

vulnerability

software update

developer information

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

18.1%

JSON

Movable Type provided by Six Apart Ltd. contains a cross-site scripting vulnerability (CWE-79).

Impact

An arbitrary script may be executed on a logged-in user’s web browser.

Solution

Update the Software
Apply the appropriate update according to the information provided by the developer.
The developer has released the following updates that contain fix for this vulnerability:

Movable Type 7 r.5501 (Movable Type 7 Series)
Movable Type Advanced 7 r.5501 (Movable Type 7 Series)
Movable Type Premium 1.59
Movable Type Premium Advanced 1.59
Movable Type Cloud Edition (Version 7) r.5501
Movable Type Premium Cloud Edition 1.59
For more information, refer to the information provided by the developer.

Products Affected

Movable Type 7 r.5405 and earlier (Movable Type 7 Series)
Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series)
Movable Type Premium 1.58 and earlier
Movable Type Premium Advanced 1.58 and earlier
Movable Type Cloud Edition (Version 7) r.5405 and earlier
Movable Type Premium Cloud Edition 1.58 and earlier