PT-2017-8756 · Six Apart · Movable Type Open Source+2

John Lightsey · Publicado 2017-01-23 · Atualizado 2017-09-01 · CVE-2016-5742

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Movable Type Pro and Advanced versions 6.0.0 through 6.1.3 Movable Type Pro and Advanced versions 6.2.0 through 6.2.6 Movable Type Open Source versions 5.2.13 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands.

Recommendations For Movable Type Pro and Advanced versions 6.0.0 through 6.1.3, update to version 6.1.3 or later. For Movable Type Pro and Advanced versions 6.2.0 through 6.2.6, update to version 6.2.6 or later. For Movable Type Open Source versions 5.2.13 and earlier, update to a version later than 5.2.13.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2016-5742

DLA-532-1

Produtos afetados

Movable Type Advanced

Movable Type Open Source

Movable Type Pro

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-5742 · Nota de Segurança
• http://securitytracker.com/id/1036160 · Nota
• http://openwall.com/lists/oss-security/2016/06/22/6 · Nota
• https://movabletype.org/news/2016/06/movable_type_626_and_613_released.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/06/22/5 · Nota
• https://osv.dev/vulnerability/CVE-2016-5742 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/06/22/3 · Nota