Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-20837
HistoryOct 26, 2021 - 6:15 a.m.

CVE-2021-20837

2021-10-2606:15:06
CWE-78
[email protected]
web.nvd.nist.gov
4
movable type
remote attackers
os commands
vulnerability
cve-2021-20837

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.968

Percentile

99.7%

JSON

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.

Affected configurations

Nvd
Node
sixapartmovable_typeRange≤1.46premium
OR
sixapartmovable_typeRange≤1.46premium_advanced
OR
sixapartmovable_typeRange4.0–6.3.11
OR
sixapartmovable_typeRange6.5.0–6.8.2-
OR
sixapartmovable_typeRange6.5.0–6.8.2advanced
OR
sixapartmovable_typeRange7.0–7.8.1-
OR
sixapartmovable_typeRange7.0–7.8.1advanced
VendorProductVersionCPE
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium:*:*:*
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium_advanced:*:*:*
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:*:*:*:*
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:-:*:*:*
sixapartmovable_type*cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*

Related

cvelist 1
githubexploit 7
prion 1
zdt 1
packetstorm 1
cve 1
openvas 1
f5 1
jvn 1
exploitdb 1
nuclei 1
cvelist
cvelist
CVE-2021-20837
2021-10-26 05:15:12
githubexploit
githubexploit
Exploit for OS Command Injection in Sixapart Movable Type
2021-10-30 09:15:56
Exploit for OS Command Injection in Sixapart Movable Type
2021-10-30 09:15:56
Exploit for OS Command Injection in Sixapart Movable Type
2021-10-30 09:15:56
prion
prion
Design/Logic Flaw
2021-10-26 06:15:00
zdt
zdt
Movable Type 7 r.5002 - XMLRPC API OS Command Injection Exploit
2021-10-29 00:00:00
packetstorm
packetstorm
Movable Type 7 r.5002 XMLRPC API Remote Command Injection
2021-10-29 00:00:00
cve
cve
CVE-2021-20837
2021-10-26 06:15:06
openvas
openvas
Movable Type RCE Vulnerability (Oct 2021) - Active Check
2021-11-01 00:00:00
f5
f5
K73078449 : Moveable Type vulnerability CVE-2021-20837
2021-12-16 00:00:00
jvn
jvn
JVN#41119755: Movable Type XMLRPC API vulnerable to OS command injection
2021-10-20 00:00:00
exploitdb
exploitdb
Movable Type 7 r.5002 - XMLRPC API OS Command Injection (Metasploit)
2021-10-29 00:00:00
nuclei
nuclei
MovableType - Remote Command Injection
2021-10-29 12:43:32

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.968

Percentile

99.7%

JSON
Related for NVD:CVE-2021-20837
cvelist1githubexploit7prion1zdt1packetstorm1cve1openvas1f51jvn1exploitdb1nuclei1