PT-2019-17950 · Six Apart · Movable Type Premium+2

Hidetomo Hosono

·

Publicado

2019-12-26

·

Atualizado

2020-01-10

·

CVE-2019-6025

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Movable Type versions 7.1.3 and earlier Movable Type 6.5.0 and 6.5.1 Movable Type versions 6.3.9 and earlier Movable Type Advanced versions 7.1.3 and earlier Movable Type Advanced 6.5.0 and 6.5.1 Movable Type Advanced versions 6.3.9 and earlier Movable Type Premium versions 1.24 and earlier Movable Type Premium (Advanced Edition) versions 1.24 and earlier
Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. This can lead to unauthorized access and potential security breaches.
Recommendations For Movable Type versions 7.1.3 and earlier, update to a version later than 7.1.3. For Movable Type 6.5.0 and 6.5.1, update to a version later than 6.5.1. For Movable Type versions 6.3.9 and earlier, update to a version later than 6.3.9. For Movable Type Advanced versions 7.1.3 and earlier, update to a version later than 7.1.3. For Movable Type Advanced 6.5.0 and 6.5.1, update to a version later than 6.5.1. For Movable Type Advanced versions 6.3.9 and earlier, update to a version later than 6.3.9. For Movable Type Premium versions 1.24 and earlier, update to a version later than 1.24. For Movable Type Premium (Advanced Edition) versions 1.24 and earlier, update to a version later than 1.24.

Correção

Open Redirect

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2019-6025

Produtos afetados

Movable Type
Movable Type Advanced
Movable Type Premium