CVE-2007-0231

Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://golem.ph.utexas.edu/~distler/blog/archives/001102.html	Vendor Advisory
http://www.zackvision.com/weblog/2007/01/movabletype-security-bug.html	Vendor Advisory
http://secunia.com/advisories/23669
http://osvdb.org/32717
http://www.vupen.com/english/advisories/2007/0142

Configurations

Configuration 1 (hide)

cpe:2.3:a:six_apart:movable_type:3.33:*:*:*:*:*:*:*

Information

Published : 2007-01-12 18:28

Updated : 2011-03-07 18:49

NVD link : CVE-2007-0231

Mitre link : CVE-2007-0231

JSON object : View

CWE

NVD-CWE-Other

Products Affected

six_apart

movable_type

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://golem.ph.utexas.edu/~distler/blog/archives/001102.html", "name": "http://golem.ph.utexas.edu/~distler/blog/archives/001102.html", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.zackvision.com/weblog/2007/01/movabletype-security-bug.html", "name": "http://www.zackvision.com/weblog/2007/01/movabletype-security-bug.html", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/23669", "name": "23669", "tags": [], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/32717", "name": "32717", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/0142", "name": "ADV-2007-0142", "tags": [], "refsource": "VUPEN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-0231", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-01-13T02:28Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:six_apart:movable_type:3.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2011-03-08T02:49Z"}

6.8 /10