Lucene search

JpcertCVE-2022-43660

HistoryDec 07, 2022 - 4:15 a.m.

CVE-2022-43660

2022-12-0704:15:10

CWE-94

jpcert

web.nvd.nist.gov

cve-2022-43660

improper neutralization

server-side includes

movable type

remote attack

authenticated attack

privilege escalation

nvd

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.002

Percentile

60.4%

JSON

Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of ‘Manage of Content Types’ may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.

Affected configurations

Nvd

Node

sixapartmovable_typeRange≤1.53premium

sixapartmovable_typeRange≤1.53premium_advanced

sixapartmovable_typeRange7.0–7.9.6-

sixapartmovable_typeRange7.0–7.9.6advanced

VendorProductVersionCPE
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium:*:*:*
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium_advanced:*:*:*
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:-:*:*:*
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*

Vendor	Product	Version	CPE
sixapart	movable_type	*	cpe:2.3:a:sixapart:movable_type:::::premium:::*
sixapart	movable_type	*	cpe:2.3:a:sixapart:movable_type:::::premium_advanced:::*
sixapart	movable_type	*	cpe:2.3:a:sixapart:movable_type:::::-:::*
sixapart	movable_type	*	cpe:2.3:a:sixapart:movable_type:::::advanced:::*

CNA Affected

[
  {
    "vendor": "Six Apart Ltd.",
    "product": "Movable Type",
    "versions": [
      {
        "version": "Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN37014768/index.html

movabletype.org/news/2022/11/mt-796-688-released.html

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.002

Percentile

60.4%

JSON

Related for CVE-2022-43660