PT-2009-1295 · Six Apart · Movable Type+2

Taichi Kaminogoya · Publicado 2009-01-02 · Atualizado 2017-08-08 · CVE-2008-5808

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Movable Type Enterprise (MTE) versions 1.x through 1.55 Movable Type (MT) versions 3.x through 3.37 Movable Type, Movable Type Open Source (MTOS), and Movable Type Enterprise versions 4.x through 4.22

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to application management.

Recommendations For Movable Type Enterprise (MTE) versions 1.x through 1.55, update to version 1.56 or later. For Movable Type (MT) versions 3.x through 3.37, update to version 3.38 or later. For Movable Type, Movable Type Open Source (MTOS), and Movable Type Enterprise versions 4.x through 4.22, update to version 4.23 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-5808

Produtos afetados

Movable Type

Movable Type Enterprise

Movable Type Open Source

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-5808 · Nota de Segurança
• http://secunia.com/advisories/32935 · Aviso do Fabricante
• http://movabletype.jp/blog/_movable_type_423.html · Nota
• http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000067.html · Nota
• http://jvn.jp/en/jp/JVN02216739/index.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5808 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47019 · Nota
• http://securityfocus.com/bid/32604 · Nota