Description (CNA)
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Six Apart Ltd. / Movable Type (8.4.x series) | affected 8.4.1 and earlier |
| Six Apart Ltd. / Movable Type (8.0.x series) | affected 8.0.5 and earlier |
| Six Apart Ltd. / Movable Type Advanced (8.4.x series) | affected 8.4.1 and earlier |
| Six Apart Ltd. / Movable Type Advanced (8.0.x series) | affected 8.0.5 and earlier |
| Six Apart Ltd. / Movable Type Premium (2.x series) | affected 2.06 and earlier |
| Six Apart Ltd. / Movable Type Premium (Advanced Edition) (2.x series) | affected 2.06 and earlier |
| Six Apart Ltd. / Movable Type Cloud Edition (8.x series) | affected 8.4.1 and earlier |
| Six Apart Ltd. / Movable Type Premium Cloud Edition (2.x series) | affected 2.06 and earlier |
CWE
CWE-79
References
ADP enrichment
No English description supplied.
No references supplied.