PT-2009-1295 · Six Apart · Movable Type+2

Taichi Kaminogoya · Published 2009-01-02 · Updated 2017-08-08 · CVE-2008-5808

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Movable Type Enterprise (MTE) versions 1.x through 1.55 Movable Type (MT) versions 3.x through 3.37 Movable Type, Movable Type Open Source (MTOS), and Movable Type Enterprise versions 4.x through 4.22

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to application management.

Recommendations For Movable Type Enterprise (MTE) versions 1.x through 1.55, update to version 1.56 or later. For Movable Type (MT) versions 3.x through 3.37, update to version 3.38 or later. For Movable Type, Movable Type Open Source (MTOS), and Movable Type Enterprise versions 4.x through 4.22, update to version 4.23 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-5808

Affected Products

Movable Type

Movable Type Enterprise

Movable Type Open Source

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-5808 · Security Note
• http://secunia.com/advisories/32935 · Vendor Advisory
• http://movabletype.jp/blog/_movable_type_423.html · Note
• http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000067.html · Note
• http://jvn.jp/en/jp/JVN02216739/index.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5808 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47019 · Note
• http://securityfocus.com/bid/32604 · Note