PT-2021-14125

CVE-2021-20665

·

Published

2021-03-05

·

Updated

2021-03-22

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Movable Type 7 versions 7.0.0 through 7 r.4705 Movable Type Advanced 7 versions 7.0.0 through 7 r.4705 Movable Type Premium version 1.39 and earlier Movable Type Premium Advanced version 1.39 and earlier
Description: A cross-site scripting issue exists in the Add asset screen of the Contents field, allowing remote attackers to inject arbitrary scripts via unspecified vectors.
Recommendations: For Movable Type 7 versions 7.0.0 through 7 r.4705, update to a version later than 7 r.4705. For Movable Type Advanced 7 versions 7.0.0 through 7 r.4705, update to a version later than 7 r.4705. For Movable Type Premium version 1.39 and earlier, update to a version later than 1.39. For Movable Type Premium Advanced version 1.39 and earlier, update to a version later than 1.39.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2021-20665
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com