CVE-2021-20663
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable…
Does this matter?
Lower severity and a low EPSS score (0.81%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- movabletype/movable type · movabletype/movable type advanced · movabletype/movable type premium · movabletype/movable type premium advanced
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN66542874/index.htmlThird Party Advisory
- https://movabletype.org/news/2021/02/mt-760-676-released.htmlRelease Notes, Vendor Advisory
- https://jvn.jp/en/jp/JVN66542874/index.htmlThird Party Advisory
- https://movabletype.org/news/2021/02/mt-760-676-released.htmlRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.