JVN#70683217: Movable Type vulnerable to cross-site request forgery

Movable Type contains a cross-site request forgery vulnerability in entering comments and community functionality.

Impact

If a user views a malicious page while logged in, settings may be changed, data may be viewed or altered.

Solution

Update the software
Update to the latest version for each product according to the information provided by the developer.

Products Affected

Version 5.12, 5.06, 4.37, 4.292 and earlier of the products listed below are vulnerable.

• Movable Type Open Source
• Movable Type (with Professional Pack, Community Pack)
• Movable Type Enterprise
• Movable Type Advanced
  For more information, refer to the information provided by the developer.