PT-2017-8756 · Six Apart · Movable Type Open Source+2

John Lightsey · Published 2017-01-23 · Updated 2017-09-01 · CVE-2016-5742

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Movable Type Pro and Advanced versions 6.0.0 through 6.1.3 Movable Type Pro and Advanced versions 6.2.0 through 6.2.6 Movable Type Open Source versions 5.2.13 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands.

Recommendations For Movable Type Pro and Advanced versions 6.0.0 through 6.1.3, update to version 6.1.3 or later. For Movable Type Pro and Advanced versions 6.2.0 through 6.2.6, update to version 6.2.6 or later. For Movable Type Open Source versions 5.2.13 and earlier, update to a version later than 5.2.13.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-5742

DLA-532-1

Affected Products

Movable Type Advanced

Movable Type Open Source

Movable Type Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-5742 · Security Note
• https://movabletype.org/news/2016/06/movable_type_626_and_613_released.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5742 · Vendor Advisory
• http://securitytracker.com/id/1036160 · Note
• http://openwall.com/lists/oss-security/2016/06/22/6 · Note
• http://openwall.com/lists/oss-security/2016/06/22/5 · Note
• http://openwall.com/lists/oss-security/2016/06/22/3 · Note