PT-2007-4619 · Six Apart · Movable Type

Teracci2002 · Published 2007-06-21 · Updated 2018-10-16 · CVE-2007-3342

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Movable Type versions prior to 3.34

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via comments. There are two specific scenarios where this can occur: (1) when comments contain a malformed SGML numeric character reference with a '0' (0x00) character in a javascript: URI, and (2) when an attribute in an element lacks the '>' character at the end of the start tag.

Recommendations For versions prior to 3.34, update to version 3.34 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-3342

Affected Products

Movable Type

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-3342 · Security Note
• http://sixapart.com/movabletype/beta/distros/MT-3.34-beta-Release-Notes.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3342 · Note
• http://securityfocus.com/archive/1/458196/100/0/threaded · Note
• http://osvdb.org/38621 · Note
• http://securityreason.com/securityalert/2821 · Note