Movable Type Prior to Version 4.22 Unspecified Cross-Site Scripting Vulnerability
BID:31826
Info
Movable Type Prior to Version 4.22 Unspecified Cross-Site Scripting Vulnerability
| Bugtraq ID: | 31826 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-4634 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 20 2008 12:00AM |
| Updated: | Apr 16 2015 05:52PM |
| Credit: | Riyuuzi Sakai, Architects , Inc. |
| Vulnerable: |
Movable Type Movable Type Enterprise 1.55 Movable Type Movable Type Enterprise 1.03 Movable Type Movable Type Enterprise 1.02 Movable Type Movable Type Enterprise 1.01 Movable Type Movable Type Community Solution 1.51 Movable Type Movable Type 3.17 Movable Type Movable Type 3.16 Movable Type Movable Type 3.2 Movable Type Movable Type 2.63 Movable Type Movable Type 2.0 Movable Type Movable Type 4.21 Movable Type Movable Type 4.13 Movable Type Movable Type 4.01 Movable Type Movable Type 3.36 Movable Type Movable Type 3.34.b1 Movable Type Movable Type 3.34 Movable Type Movable Type 3.33 Movable Type Movable Type 3.32 Movable Type Movable Type 3.31 Movable Type Movable Type 3.3 |
| Not Vulnerable: |
Movable Type Movable Type Enterprise 4.22 Movable Type Movable Type Community Solution 4.22 Movable Type Movable Type Commercial 4.22 Movable Type Movable Type 4.22 |
Discussion
Movable Type Prior to Version 4.22 Unspecified Cross-Site Scripting Vulnerability
Movable Type is prone to an unspecified cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.
An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Movable Type 4.22 are affected by this issue.
Movable Type is prone to an unspecified cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.
An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Movable Type 4.22 are affected by this issue.
Exploit / POC
Movable Type Prior to Version 4.22 Unspecified Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Movable Type Prior to Version 4.22 Unspecified Cross-Site Scripting Vulnerability
Solution:
The vendor has released Movable Type 4.22 to address this issue. Please contact the vendor for details.
Solution:
The vendor has released Movable Type 4.22 to address this issue. Please contact the vendor for details.
References
Movable Type Prior to Version 4.22 Unspecified Cross-Site Scripting Vulnerability
References:
References:
- Movable Type 4.22 (Moveable Type)
- Movable Type Home Page (Six Apart)
- JVN#81490697 Movable Type (JVN)