CVE-2016-5742
SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.64% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- sixapart/movable type · sixapart/movable type open source
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2016/06/22/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/06/22/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/06/22/6Mailing List, Third Party Advisory
- http://www.securitytracker.com/id/1036160
- https://movabletype.org/news/2016/06/movable_type_626_and_613_released.htmlRelease Notes, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/06/22/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/06/22/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/06/22/6Mailing List, Third Party Advisory
- http://www.securitytracker.com/id/1036160
- https://movabletype.org/news/2016/06/movable_type_626_and_613_released.htmlRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.