Movable Type Prior to Version 4.25 Unspecified Cross-Site Scripting Vulnerability
BID:34703
Info
Movable Type Prior to Version 4.25 Unspecified Cross-Site Scripting Vulnerability
| Bugtraq ID: | 34703 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 20 2009 12:00AM |
| Updated: | Apr 27 2009 04:16PM |
| Credit: | JVN |
| Vulnerable: |
Movable Type Movable Type Pro 4.24 Movable Type Movable Type Pro 4 Movable Type Movable Type Open Source 4.24 Movable Type Movable Type Open Source 4.23 Movable Type Movable Type Open Source 4 Movable Type Movable Type Enterprise 4.24 Movable Type Movable Type Enterprise 4.23 Movable Type Movable Type Enterprise 4.22 Movable Type Movable Type Enterprise 4 Movable Type Movable Type Enterprise 1.56 Movable Type Movable Type Enterprise 1.55 Movable Type Movable Type Enterprise 1.5 Movable Type Movable Type Enterprise 1.03 Movable Type Movable Type Enterprise 1.02 Movable Type Movable Type Enterprise 1.01 Movable Type Movable Type Community Solution 4.24 Movable Type Movable Type Community Solution 4.23 Movable Type Movable Type Community Solution 4.22 Movable Type Movable Type Community Solution 4 Movable Type Movable Type Community Solution 1.51 Movable Type Movable Type Commercial 4.22 Movable Type Movable Type 3.17 Movable Type Movable Type 3.16 Movable Type Movable Type 3.2 Movable Type Movable Type 2.63 Movable Type Movable Type 2.0 Movable Type Movable Type 4.24 Movable Type Movable Type 4.23 Movable Type Movable Type 4.22 Movable Type Movable Type 4.21 Movable Type Movable Type 4.13 Movable Type Movable Type 4.01 Movable Type Movable Type 4 Movable Type Movable Type 3.38 Movable Type Movable Type 3.36 Movable Type Movable Type 3.34.b1 Movable Type Movable Type 3.34 Movable Type Movable Type 3.33 Movable Type Movable Type 3.32 Movable Type Movable Type 3.31 Movable Type Movable Type 3.3 Movable Type Movable Type 3 |
| Not Vulnerable: |
Movable Type Movable Type Pro 4.25 Movable Type Movable Type Open Source 4.25 Movable Type Movable Type Enterprise 4.24 Movable Type Movable Type Community Solution 4.25 Movable Type Movable Type 4.25 |
Discussion
Movable Type Prior to Version 4.25 Unspecified Cross-Site Scripting Vulnerability
Movable Type is prone to an unspecified cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.
An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Movable Type 4.25 are affected.
Movable Type is prone to an unspecified cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.
An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to Movable Type 4.25 are affected.
Exploit / POC
Movable Type Prior to Version 4.25 Unspecified Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Movable Type Prior to Version 4.25 Unspecified Cross-Site Scripting Vulnerability
Solution:
The vendor has released Movable Type 4.25 to address this issue. Please contact the vendor for details.
Solution:
The vendor has released Movable Type 4.25 to address this issue. Please contact the vendor for details.
References
Movable Type Prior to Version 4.25 Unspecified Cross-Site Scripting Vulnerability
References:
References:
- Movable Type Home Page (Six Apart)
- Movable Type 4.24 security issues (Movable Type)