Movable Type CVE-2014-5313 Cross Site Scripting Vulnerability

Bugtraq ID:	69729
Class:	Input Validation Error
CVE:	CVE-2014-5313
Remote:	Yes
Local:	No
Published:	Sep 09 2014 12:00AM
Updated:	Sep 09 2014 12:00AM
Credit:	Saeki Tominaga
Vulnerable:	Movable Type Movable Type 5.14
Not Vulnerable:	Movable Type Movable Type 5.2

Movable Type CVE-2014-5313 Cross Site Scripting Vulnerability

Movable Type is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Movable Type 5.14 is vulnerable; other versions may also be affected.

Movable Type CVE-2014-5313 Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

Movable Type CVE-2014-5313 Cross Site Scripting Vulnerability

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Movable Type CVE-2014-5313 Cross Site Scripting Vulnerability

References:

• Movable Type Homepage (Movable Type)
  
• Movable Type vulnerable to cross-site scripting (JPCERT)