PT-2012-3311 · Six Apart · Movable Type

Publicado 2012-03-03 · Atualizado 2018-01-18 · CVE-2012-1497

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Movable Type versions prior to 4.38 Movable Type versions 5.0x prior to 5.07 Movable Type versions 5.1x prior to 5.13

Description The issue allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role, due to the default configuration supporting the mt:Include file= attribute.

Recommendations For versions prior to 4.38, update to version 4.38 or later. For versions 5.0x prior to 5.07, update to version 5.07 or later. For versions 5.1x prior to 5.13, update to version 5.13 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-1497

DSA-2423-1

Produtos afetados

Movable Type

Referências · 4

• http://movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1497 · Nota de Segurança
• http://movabletype.org/documentation/appendices/release-notes/513.html · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2423 · Aviso do Fabricante