XSS in Movabletype Movable Type Advanced
CVE-2012-0318
Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to inject arbitrary web script or HTML via vectors involving templates, a different issue than CVE-2012-1262.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.013 (68.4th percentile) — read the EPSS interpretation.
Affected products
- Movabletype Movable_type_advanced — versions 4.0, 4.1, 4.01
- Movabletype Movable_type_enterprise — versions 4.0, 4.1, 4.01
- Movabletype Movable_type_open_source — versions 4.0, 4.1, 4.01
- Movabletype Movable_type_pro — versions 4.0, 4.1, 4.01
- N/a — versions n/a
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_CONFIRM, Patch, Vendor Advisory)
- vultures@jpcert.or.jp (vdb-entry, x_refsource_BID)
- vultures@jpcert.or.jp (vendor-advisory, x_refsource_DEBIAN)
- vultures@jpcert.or.jp (vdb-entry, x_refsource_SECTRACK)
- vultures@jpcert.or.jp (x_refsource_CONFIRM, Patch, Vendor Advisory)
- vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)
- vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)