XSS in Sixapart Movable Type
CVE-2023-45746
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (28.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Sixapart Movable_type
- Six Apart Ltd. Movable Type 7 (Movable Series) — versions r.5405 and earlier
- Six Apart Ltd. Movable Type Advanced 7 (Movable Series) — versions r.5405 and earlier
- Six Apart Ltd. Movable Type Cloud Edition (Version 7) — versions r.5405 and earlier
- Six Apart Ltd. Movable Type Premium — versions 1.58 and earlier
- Six Apart Ltd. Movable Type Premium Advanced — versions 1.58 and earlier
- Six Apart Ltd. Movable Type Premium Cloud Edition — versions 1.58 and earlier
Weakness classification (CWE)
Public proof-of-concept exploits
References
- vultures@jpcert.or.jp (Release Notes)
- vultures@jpcert.or.jp (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-45746?
- CVE-2023-45746 is a medium-severity vulnerability in Sixapart Movable Type, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2023-10-30.
- How severe is CVE-2023-45746?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2023-45746 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.