RCE in Movabletype Movable Type Advanced
CVE-2012-0319
The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote authenticated users to execute arbitrary commands by leveraging the file-upload feature, related to an "OS Command Injection" issue.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.024 (82.5th percentile) — read the EPSS interpretation.
Affected products
- Movabletype Movable_type_advanced — versions 4.0, 4.1, 4.01
- Movabletype Movable_type_enterprise — versions 4.0, 4.1, 4.01
- Movabletype Movable_type_open_source — versions 4.0, 4.1, 4.01
- Movabletype Movable_type_pro — versions 4.0, 4.1, 4.01
- N/a — versions n/a
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_CONFIRM, Patch, Vendor Advisory)
- vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)
- vultures@jpcert.or.jp (vdb-entry, x_refsource_BID)
- vultures@jpcert.or.jp (vendor-advisory, x_refsource_DEBIAN)
- vultures@jpcert.or.jp (vdb-entry, x_refsource_SECTRACK)
- vultures@jpcert.or.jp (x_refsource_CONFIRM, Patch, Vendor Advisory)
- vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)