CVE-2023-45746
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script.
Does this matter?
Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.35% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- sixapart/movable type
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN39139884/Third Party Advisory
- https://movabletype.org/news/2023/10/mt-79020-released.htmlRelease Notes
- https://jvn.jp/en/jp/JVN39139884/Third Party Advisory
- https://movabletype.org/news/2023/10/mt-79020-released.htmlRelease Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.