Description (CNA)
Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Six Apart Ltd. / Movable Type (8.4.x series) | affected 8.4.1 and earlier |
| Six Apart Ltd. / Movable Type (8.0.x series) | affected 8.0.5 and earlier |
| Six Apart Ltd. / Movable Type Advanced (8.4.x series) | affected 8.4.1 and earlier |
| Six Apart Ltd. / Movable Type Advanced (8.0.x series) | affected 8.0.5 and earlier |
| Six Apart Ltd. / Movable Type Premium (2.x series) | affected 2.06 and earlier |
| Six Apart Ltd. / Movable Type Premium (Advanced Edition) (2.x series) | affected 2.06 and earlier |
| Six Apart Ltd. / Movable Type Cloud Edition (8.x series) | affected 8.4.1 and earlier |
| Six Apart Ltd. / Movable Type Premium Cloud Edition (2.x series) | affected 2.06 and earlier |
CWE
CWE-79
References
ADP enrichment
No English description supplied.
No references supplied.