Description
Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.
References (2)
Core 2
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN37014768/index.html
Release Notes, Vendor Advisory
https://movabletype.org/news/2022/11/mt-796-688-released.html
Scores
CVSS v3
7.2
EPSS
0.0097
EPSS Percentile
57.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (2)
sixapart/movable_type
< 1.53 (2 CPE variants)
sixapart/movable_type
7.0 - 7.9.6 (2 CPE variants)
Published
Dec 07, 2022
Tracked Since
Feb 18, 2026