PT-2010-5172 · Six Apart · Movable Type

Published 2010-12-09 · Updated 2011-01-12 · CVE-2010-3922

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Movable Type versions 4.x through 4.34 Movable Type versions 5.x through 5.03

Description The issue allows remote attackers to execute arbitrary SQL commands.

Recommendations For Movable Type versions 4.x through 4.34, update to version 4.35 or later. For Movable Type versions 5.x through 5.03, update to version 5.04 or later.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-3922

Affected Products

Movable Type

References · 8

• http://secunia.com/advisories/42539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3922 · Security Note
• http://vupen.com/english/advisories/2010/3145 · Note
• http://movabletype.org/documentation/appendices/release-notes/movable-type-504-435-release-notes.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3922 · Note
• http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000061.html · Note
• http://jvn.jp/en/jp/JVN78536512/index.html · Note
• http://securitytracker.com/id?1024833 · Note