CVE-2012-0317
Summary
| CVE | CVE-2012-0317 |
|---|---|
| State | PUBLISHED |
| Assigner | jpcert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-03-03 04:04:57 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sixapart | Movable Type | 4.0 | All | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta2 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta3 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta4 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta5 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta6 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta7 | All | All |
| Application | Sixapart | Movable Type | 4.0 | rc1 | All | All |
| Application | Sixapart | Movable Type | 4.0 | rc2 | All | All |
| Application | Sixapart | Movable Type | 4.0 | rc3 | All | All |
| Application | Sixapart | Movable Type | 4.1 | beta | All | All |
| Application | Sixapart | Movable Type | 4.1 | beta2 | All | All |
| Application | Sixapart | Movable Type | 4.1 | rc1 | All | All |
| Application | Sixapart | Movable Type | 4.12 | All | All | All |
| Application | Sixapart | Movable Type | 4.15 | beta1 | All | All |
| Application | Sixapart | Movable Type | 4.15 | beta3 | All | All |
| Application | Sixapart | Movable Type | 4.15 | beta4 | All | All |
| Application | Sixapart | Movable Type | 4.2 | All | All | All |
| Application | Sixapart | Movable Type | 4.2 | rc2 | All | All |
| Application | Sixapart | Movable Type | 4.2 | rc4 | All | All |
| Application | Sixapart | Movable Type | 4.2 | rc5 | All | All |
| Application | Sixapart | Movable Type | 4.22 | All | All | All |
| Application | Sixapart | Movable Type | 4.23 | All | All | All |
| Application | Sixapart | Movable Type | 4.24 | All | All | All |
| Application | Sixapart | Movable Type | 4.25 | All | All | All |
| Application | Sixapart | Movable Type | 4.26 | All | All | All |
| Application | Sixapart | Movable Type | 4.261 | All | All | All |
| Application | Sixapart | Movable Type | 4.27 | All | All | All |
| Application | Sixapart | Movable Type | 4.28 | All | All | All |
| Application | Sixapart | Movable Type | 4.28 | All | enterprise | All |
| Application | Sixapart | Movable Type | 4.28 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.29 | All | All | All |
| Application | Sixapart | Movable Type | 4.29 | All | enterprise | All |
| Application | Sixapart | Movable Type | 4.29 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.291 | All | All | All |
| Application | Sixapart | Movable Type | 4.291 | All | enterprise | All |
| Application | Sixapart | Movable Type | 4.291 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.292 | All | All | All |
| Application | Sixapart | Movable Type | 4.292 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.35 | All | All | All |
| Application | Sixapart | Movable Type | 4.36 | All | All | All |
| Application | Sixapart | Movable Type | 4.36 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.361 | All | All | All |
| Application | Sixapart | Movable Type | 4.361 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.37 | All | All | All |
| Application | Sixapart | Movable Type | 5.0 | All | All | All |
| Application | Sixapart | Movable Type | 5.0 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.0 | beta1 | All | All |
| Application | Sixapart | Movable Type | 5.0 | beta2 | All | All |
| Application | Sixapart | Movable Type | 5.0 | beta3 | All | All |
| Application | Sixapart | Movable Type | 5.0 | beta4 | All | All |
| Application | Sixapart | Movable Type | 5.0 | rc1 | All | All |
| Application | Sixapart | Movable Type | 5.0 | rc2 | All | All |
| Application | Sixapart | Movable Type | 5.0 | rc3 | All | All |
| Application | Sixapart | Movable Type | 5.01 | All | All | All |
| Application | Sixapart | Movable Type | 5.01 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.02 | All | All | All |
| Application | Sixapart | Movable Type | 5.02 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.02 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.03 | All | All | All |
| Application | Sixapart | Movable Type | 5.031 | All | All | All |
| Application | Sixapart | Movable Type | 5.04 | All | All | All |
| Application | Sixapart | Movable Type | 5.04 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.04 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.05 | All | All | All |
| Application | Sixapart | Movable Type | 5.05 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.05 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.051 | All | All | All |
| Application | Sixapart | Movable Type | 5.051 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.051 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.06 | All | All | All |
| Application | Sixapart | Movable Type | 5.06 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.06 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.07 | All | All | All |
| Application | Sixapart | Movable Type | 5.1 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.1 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.1 | beta | All | All |
| Application | Sixapart | Movable Type | 5.1 | rc1 | All | All |
| Application | Sixapart | Movable Type | 5.11 | All | All | All |
| Application | Sixapart | Movable Type | 5.11 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.11 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.12 | All | All | All |
| Application | Sixapart | Movable Type | 5.12 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.12 | All | open_source | All |
| Application | Sixapart | Movable Type | All | All | enterprise | All |
| Application | Sixapart | Movable Type | All | All | open_source | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Movable Type 5.13, 5.07, and 4.38 Security Updates | MovableType.org - Home of the MT Community | af854a3a-2127-422b-91ae-364da2661108 | www.movabletype.org | Patch, Vendor Advisory |
| Movable Type Flaws Permit Remote Authenticated Command Injection and Remote Cross-Site Scripting and Cross-Site Request Forgery Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Debian -- Security Information -- DSA-2423-1 movabletype-opensource | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Movable Type Multiple Remote Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| JVN#70683217: Movable Type vulnerable to cross-site request forgery | af854a3a-2127-422b-91ae-364da2661108 | jvn.jp | |
| jvndb.jvn.jp/jvndb/JVNDB-2012-000015 | af854a3a-2127-422b-91ae-364da2661108 | jvndb.jvn.jp | |
| Movable Type 5.13, 5.07, and 4.38 Release Notes | MovableType.org - Home of the MT Community | af854a3a-2127-422b-91ae-364da2661108 | www.movabletype.org | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.