CVE-2012-1262
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the…
Does this matter?
Lower severity and a low EPSS score (1.90%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.90% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- movabletype/movable type open source · movabletype/movable type enterprise · movabletype/movable type advanced · movabletype/movable type pro
- Source
- cve@mitre.org
References
- http://jvn.jp/en/jp/JVN49836527/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016
- http://osvdb.org/79470
- http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2012/Feb/407
- http://www.debian.org/security/2012/dsa-2423
- http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.htmlPatch, Vendor Advisory
- http://www.movabletype.org/documentation/appendices/release-notes/513.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/52138
- http://www.securitytracker.com/id?1026738
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73411
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73480
- https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txtExploit
- http://jvn.jp/en/jp/JVN49836527/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016
- http://osvdb.org/79470
- http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2012/Feb/407
- http://www.debian.org/security/2012/dsa-2423
- http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.htmlPatch, Vendor Advisory
- http://www.movabletype.org/documentation/appendices/release-notes/513.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/52138
- http://www.securitytracker.com/id?1026738
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73411
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73480
- https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txtExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.