VulnerabilityModified

CVE-2014-5313

Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

LOW 3.5EPSS 0.97%

Does this matter?

Lower severity and a low EPSS score (0.97%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0: 3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
EPSS: 0.97% probability · 60th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: sixapart/movabletype
Source: vultures@jpcert.or.jp

References

http://jvn.jp/en/jp/JVN73357573/370331/index.html
http://jvn.jp/en/jp/JVN73357573/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000104
http://jvn.jp/en/jp/JVN73357573/370331/index.html
http://jvn.jp/en/jp/JVN73357573/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000104

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.