CVE-2012-0320
Summary
| CVE | CVE-2012-0320 |
|---|---|
| State | PUBLISHED |
| Assigner | jpcert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-03-03 04:04:57 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the (1) commenting feature and (2) community script. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-noinfo | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sixapart | Movable Type | 4.0 | All | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta2 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta3 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta4 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta5 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta6 | All | All |
| Application | Sixapart | Movable Type | 4.0 | beta7 | All | All |
| Application | Sixapart | Movable Type | 4.0 | rc1 | All | All |
| Application | Sixapart | Movable Type | 4.0 | rc2 | All | All |
| Application | Sixapart | Movable Type | 4.0 | rc3 | All | All |
| Application | Sixapart | Movable Type | 4.1 | beta | All | All |
| Application | Sixapart | Movable Type | 4.1 | beta2 | All | All |
| Application | Sixapart | Movable Type | 4.1 | rc1 | All | All |
| Application | Sixapart | Movable Type | 4.12 | All | All | All |
| Application | Sixapart | Movable Type | 4.15 | beta1 | All | All |
| Application | Sixapart | Movable Type | 4.15 | beta3 | All | All |
| Application | Sixapart | Movable Type | 4.15 | beta4 | All | All |
| Application | Sixapart | Movable Type | 4.2 | All | All | All |
| Application | Sixapart | Movable Type | 4.2 | rc2 | All | All |
| Application | Sixapart | Movable Type | 4.2 | rc4 | All | All |
| Application | Sixapart | Movable Type | 4.2 | rc5 | All | All |
| Application | Sixapart | Movable Type | 4.22 | All | All | All |
| Application | Sixapart | Movable Type | 4.23 | All | All | All |
| Application | Sixapart | Movable Type | 4.24 | All | All | All |
| Application | Sixapart | Movable Type | 4.25 | All | All | All |
| Application | Sixapart | Movable Type | 4.26 | All | All | All |
| Application | Sixapart | Movable Type | 4.261 | All | All | All |
| Application | Sixapart | Movable Type | 4.27 | All | All | All |
| Application | Sixapart | Movable Type | 4.28 | All | All | All |
| Application | Sixapart | Movable Type | 4.28 | All | enterprise | All |
| Application | Sixapart | Movable Type | 4.28 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.29 | All | All | All |
| Application | Sixapart | Movable Type | 4.29 | All | enterprise | All |
| Application | Sixapart | Movable Type | 4.29 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.291 | All | All | All |
| Application | Sixapart | Movable Type | 4.291 | All | enterprise | All |
| Application | Sixapart | Movable Type | 4.291 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.292 | All | All | All |
| Application | Sixapart | Movable Type | 4.292 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.35 | All | All | All |
| Application | Sixapart | Movable Type | 4.36 | All | All | All |
| Application | Sixapart | Movable Type | 4.36 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.361 | All | All | All |
| Application | Sixapart | Movable Type | 4.361 | All | open_source | All |
| Application | Sixapart | Movable Type | 4.37 | All | All | All |
| Application | Sixapart | Movable Type | 5.0 | All | All | All |
| Application | Sixapart | Movable Type | 5.0 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.0 | beta1 | All | All |
| Application | Sixapart | Movable Type | 5.0 | beta2 | All | All |
| Application | Sixapart | Movable Type | 5.0 | beta3 | All | All |
| Application | Sixapart | Movable Type | 5.0 | beta4 | All | All |
| Application | Sixapart | Movable Type | 5.0 | rc1 | All | All |
| Application | Sixapart | Movable Type | 5.0 | rc2 | All | All |
| Application | Sixapart | Movable Type | 5.0 | rc3 | All | All |
| Application | Sixapart | Movable Type | 5.01 | All | All | All |
| Application | Sixapart | Movable Type | 5.01 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.02 | All | All | All |
| Application | Sixapart | Movable Type | 5.02 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.02 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.03 | All | All | All |
| Application | Sixapart | Movable Type | 5.031 | All | All | All |
| Application | Sixapart | Movable Type | 5.04 | All | All | All |
| Application | Sixapart | Movable Type | 5.04 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.04 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.05 | All | All | All |
| Application | Sixapart | Movable Type | 5.05 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.05 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.051 | All | All | All |
| Application | Sixapart | Movable Type | 5.051 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.051 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.06 | All | All | All |
| Application | Sixapart | Movable Type | 5.06 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.06 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.07 | All | All | All |
| Application | Sixapart | Movable Type | 5.1 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.1 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.1 | beta | All | All |
| Application | Sixapart | Movable Type | 5.1 | rc1 | All | All |
| Application | Sixapart | Movable Type | 5.11 | All | All | All |
| Application | Sixapart | Movable Type | 5.11 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.11 | All | open_source | All |
| Application | Sixapart | Movable Type | 5.12 | All | All | All |
| Application | Sixapart | Movable Type | 5.12 | All | advanced | All |
| Application | Sixapart | Movable Type | 5.12 | All | open_source | All |
| Application | Sixapart | Movable Type | All | All | enterprise | All |
| Application | Sixapart | Movable Type | All | All | open_source | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Movable Type 5.13, 5.07, and 4.38 Security Updates | MovableType.org - Home of the MT Community | af854a3a-2127-422b-91ae-364da2661108 | www.movabletype.org | Patch, Vendor Advisory |
| Movable Type Flaws Permit Remote Authenticated Command Injection and Remote Cross-Site Scripting and Cross-Site Request Forgery Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Debian -- Security Information -- DSA-2423-1 movabletype-opensource | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Movable Type Multiple Remote Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| jvndb.jvn.jp/jvndb/JVNDB-2012-000018 | af854a3a-2127-422b-91ae-364da2661108 | jvndb.jvn.jp | |
| JVN#20083397: Movable Type vulnerable to session hijacking | af854a3a-2127-422b-91ae-364da2661108 | jvn.jp | |
| Movable Type 5.13, 5.07, and 4.38 Release Notes | MovableType.org - Home of the MT Community | af854a3a-2127-422b-91ae-364da2661108 | www.movabletype.org | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.