Lucene search

K

[email protected]NVD:CVE-2013-0209

HistoryJan 23, 2013 - 1:55 a.m.

CVE-2013-0209

2013-01-2301:55:01

CWE-287

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.116 Low

EPSS

Percentile

95.3%

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

Affected configurations

NVD

Node

sixapartmovable_typeMatch4.21

OR

sixapartmovable_typeMatch4.22

OR

sixapartmovable_typeMatch4.23

OR

sixapartmovable_typeMatch4.24

OR

sixapartmovable_typeMatch4.25

OR

sixapartmovable_typeMatch4.26

OR

sixapartmovable_typeMatch4.27

OR

sixapartmovable_typeMatch4.28

OR

sixapartmovable_typeMatch4.28enterprise

OR

sixapartmovable_typeMatch4.28open_source

OR

sixapartmovable_typeMatch4.29

OR

sixapartmovable_typeMatch4.29enterprise

OR

sixapartmovable_typeMatch4.29open_source

OR

sixapartmovable_typeMatch4.31

OR

sixapartmovable_typeMatch4.32

OR

sixapartmovable_typeMatch4.33

OR

sixapartmovable_typeMatch4.34

OR

sixapartmovable_typeMatch4.35

OR

sixapartmovable_typeMatch4.36

OR

sixapartmovable_typeMatch4.37

OR

sixapartmovable_typeMatch4.38

OR

sixapartmovable_typeMatch4.261

OR

sixapartmovable_typeMatch4.291

OR

sixapartmovable_typeMatch4.291enterprise

OR

sixapartmovable_typeMatch4.291open_source

OR

sixapartmovable_typeMatch4.292

OR

sixapartmovable_typeMatch4.292enterprise

OR

sixapartmovable_typeMatch4.292open_source

OR

sixapartmovable_typeMatch4.361

Node

sixapartmovable_typeMatch4.36open_source

OR

sixapartmovable_typeMatch4.37open_source

OR

sixapartmovable_typeMatch4.38open_source

OR

sixapartmovable_typeMatch4.361open_source

References

openwall.com/lists/oss-security/2013/01/22/3

www.movabletype.org/2013/01/movable_type_438_patch.html

www.sec-1.com/blog/?p=402

www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

Low

0.116 Low

EPSS

Percentile

95.3%

Related for NVD:CVE-2013-0209

openvas3 nessus2 securityvulns2 cve2 prion1 seebug1 debian1 checkpoint_advisories1 metasploit1 ubuntucve1 cvelist1 packetstorm1 nvd1 exploitdb1