Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
References
| Link | Resource |
|---|---|
| https://jvn.jp/en/jp/JVN66542874/index.html | Third Party Advisory |
| https://movabletype.org/news/2021/02/mt-760-676-released.html | Release Notes Vendor Advisory |
| https://jvn.jp/en/jp/JVN66542874/index.html | Third Party Advisory |
| https://movabletype.org/news/2021/02/mt-760-676-released.html | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jvn.jp/en/jp/JVN66542874/index.html - Third Party Advisory | |
| References | () https://movabletype.org/news/2021/02/mt-760-676-released.html - Release Notes, Vendor Advisory |
Information
Published : 2021-03-05 10:15
Updated : 2024-11-21 05:46
NVD link : CVE-2021-20664
Mitre link : CVE-2021-20664
CVE.ORG link : CVE-2021-20664
JSON object : View
Products Affected
movabletype
- movable_type_advanced
- movable_type
- movable_type_premium_advanced
- movable_type_premium
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')