XSS in Sixapart Movabletype
CVE-2014-5313
Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.010 (58.2th percentile) — read the EPSS interpretation.
Affected products
- Sixapart Movabletype — versions 5.04, 5.11, 5.12
- N/a — versions n/a
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)
- vultures@jpcert.or.jp (x_refsource_CONFIRM)
- vultures@jpcert.or.jp (x_refsource_JVN, Vendor Advisory, third-party-advisory)