PT-2005-5354 · Six Apart · Movable Type

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4689

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Six Apart Movable Type version 3.16

Description The issue allows remote attackers to login to an account by sniffing a cookie that contains account names and password hashes.

Recommendations For version 3.16, consider implementing secure cookie handling practices to prevent unauthorized access, such as using secure protocols for cookie transmission and restricting access to sensitive information stored in cookies.

Fix

Related Identifiers

CVE-2005-4689

Affected Products

Movable Type

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4689 · Security Note
• http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html · Vendor Advisory
• http://sixapart.com/movabletype/docs/3.2/h_changelog/3_2.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4689 · Note