JVN#89550319: Movable Type vulnerable to cross-site scripting

Movable Type provided by Six Apart, Ltd. is a content management system. Movable Type contains a cross-site scripting vulnerability (CWE-79).

Impact

An arbitrary script may be executed on the user’s web browser.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Apply a Workaround
If you continue to use older version that does not contains a fix for this vulnerability, apply the following workaround to mitigate the impact of this vulnerability.
Delete the directory listed below.

• <MT_HOME>/php/extlib/adodb5/tests

Products Affected

• Movable Type versions prior to Ver. 6.3.1