XSS in Sixapart Movabletype
CVE-2014-0977
Cross-site scripting (XSS) vulnerability in the Rich Text Editor in Movable Type 5.0x, 5.1x before 5.161, 5.2.x before 5.2.9, and 6.0.x before 6.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.024 (82.6th percentile) — read the EPSS interpretation.
Affected products
- Sixapart Movabletype — versions 5.0, 5.01, 5.2
- N/a — versions n/a
Weakness classification (CWE)
References
- security@debian.org (vdb-entry, x_refsource_SECTRACK)
- security@debian.org (x_refsource_CONFIRM, Vendor Advisory)
- security@debian.org (x_refsource_SECUNIA, third-party-advisory)
- security@debian.org (x_refsource_CONFIRM)
- security@debian.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- security@debian.org (vendor-advisory, x_refsource_DEBIAN)
- security@debian.org (vdb-entry, x_refsource_XF)
- security@debian.org (mailing-list, x_refsource_MLIST)
- security@debian.org (mailing-list, x_refsource_MLIST)
- security@debian.org (vdb-entry, x_refsource_BID)