CVE-2012-1497 The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory tr...
MediumCVSS 4.0
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| movabletype movable type open source | <= 4.37 | No fix listed |
| movabletype movable type open source | = 4.0 | No fix listed |
| movabletype movable type open source | = 4.0-beta | No fix listed |
| movabletype movable type open source | = 4.1 | No fix listed |
| movabletype movable type open source | = 4.1-beta | No fix listed |
| movabletype movable type open source | = 4.01-beta | No fix listed |
| movabletype movable type open source | = 4.2 | No fix listed |
| movabletype movable type open source | = 4.2-beta | No fix listed |
| movabletype movable type open source | = 4.3 | No fix listed |
| movabletype movable type open source | = 4.23 | No fix listed |
| movabletype movable type open source | = 4.25 | No fix listed |
| movabletype movable type open source | = 4.26 | No fix listed |
| movabletype movable type open source | = 4.31 | No fix listed |
| movabletype movable type open source | = 4.32 | No fix listed |
| movabletype movable type open source | = 4.33 | No fix listed |
| movabletype movable type open source | = 4.34 | No fix listed |
| movabletype movable type open source | = 4.35 | No fix listed |
| movabletype movable type open source | = 4.36 | No fix listed |
| movabletype movable type open source | = 4.261 | No fix listed |
| movabletype movable type open source | = 4.361 | No fix listed |
| movabletype movable type open source | = 5.1 | No fix listed |
| movabletype movable type open source | = 5.02 | No fix listed |
| movabletype movable type open source | = 5.03 | No fix listed |
| movabletype movable type open source | = 5.04 | No fix listed |
| movabletype movable type open source | = 5.05 | No fix listed |
Show 95 more
| Product | Affected versions | Fixed in |
|---|---|---|
| movabletype movable type open source | = 5.06 | No fix listed |
| movabletype movable type open source | = 5.11 | No fix listed |
| movabletype movable type open source | = 5.12 | No fix listed |
| movabletype movable type open source | = 5.031 | No fix listed |
| movabletype movable type open source | = 5.051 | No fix listed |
| movabletype movable type enterprise | <= 4.37 | No fix listed |
| movabletype movable type enterprise | = 4.0 | No fix listed |
| movabletype movable type enterprise | = 4.0-beta | No fix listed |
| movabletype movable type enterprise | = 4.1 | No fix listed |
| movabletype movable type enterprise | = 4.01-beta | No fix listed |
| movabletype movable type enterprise | = 4.1-beta | No fix listed |
| movabletype movable type enterprise | = 4.2 | No fix listed |
| movabletype movable type enterprise | = 4.2-beta | No fix listed |
| movabletype movable type enterprise | = 4.3 | No fix listed |
| movabletype movable type enterprise | = 4.23 | No fix listed |
| movabletype movable type enterprise | = 4.25 | No fix listed |
| movabletype movable type enterprise | = 4.26 | No fix listed |
| movabletype movable type enterprise | = 4.31 | No fix listed |
| movabletype movable type enterprise | = 4.32 | No fix listed |
| movabletype movable type enterprise | = 4.33 | No fix listed |
| movabletype movable type enterprise | = 4.34 | No fix listed |
| movabletype movable type enterprise | = 4.35 | No fix listed |
| movabletype movable type enterprise | = 4.36 | No fix listed |
| movabletype movable type enterprise | = 4.261 | No fix listed |
| movabletype movable type enterprise | = 4.361 | No fix listed |
| movabletype movable type enterprise | = 5.1 | No fix listed |
| movabletype movable type enterprise | = 5.02 | No fix listed |
| movabletype movable type enterprise | = 5.03 | No fix listed |
| movabletype movable type enterprise | = 5.04 | No fix listed |
| movabletype movable type enterprise | = 5.05 | No fix listed |
| movabletype movable type enterprise | = 5.06 | No fix listed |
| movabletype movable type enterprise | = 5.11 | No fix listed |
| movabletype movable type enterprise | = 5.12 | No fix listed |
| movabletype movable type enterprise | = 5.031 | No fix listed |
| movabletype movable type enterprise | = 5.051 | No fix listed |
| movabletype movable type advanced | <= 4.37 | No fix listed |
| movabletype movable type advanced | = 4.0 | No fix listed |
| movabletype movable type advanced | = 4.0-beta | No fix listed |
| movabletype movable type advanced | = 4.1 | No fix listed |
| movabletype movable type advanced | = 4.01-beta | No fix listed |
| movabletype movable type advanced | = 4.1-beta | No fix listed |
| movabletype movable type advanced | = 4.2 | No fix listed |
| movabletype movable type advanced | = 4.2-beta | No fix listed |
| movabletype movable type advanced | = 4.3 | No fix listed |
| movabletype movable type advanced | = 4.23 | No fix listed |
| movabletype movable type advanced | = 4.25 | No fix listed |
| movabletype movable type advanced | = 4.26 | No fix listed |
| movabletype movable type advanced | = 4.31 | No fix listed |
| movabletype movable type advanced | = 4.32 | No fix listed |
| movabletype movable type advanced | = 4.33 | No fix listed |
| movabletype movable type advanced | = 4.34 | No fix listed |
| movabletype movable type advanced | = 4.35 | No fix listed |
| movabletype movable type advanced | = 4.36 | No fix listed |
| movabletype movable type advanced | = 4.261 | No fix listed |
| movabletype movable type advanced | = 4.361 | No fix listed |
| movabletype movable type advanced | = 5.1 | No fix listed |
| movabletype movable type advanced | = 5.02 | No fix listed |
| movabletype movable type advanced | = 5.03 | No fix listed |
| movabletype movable type advanced | = 5.04 | No fix listed |
| movabletype movable type advanced | = 5.05 | No fix listed |
| movabletype movable type advanced | = 5.06 | No fix listed |
| movabletype movable type advanced | = 5.11 | No fix listed |
| movabletype movable type advanced | = 5.12 | No fix listed |
| movabletype movable type advanced | = 5.031 | No fix listed |
| movabletype movable type advanced | = 5.051 | No fix listed |
| movabletype movable type pro | <= 4.37 | No fix listed |
| movabletype movable type pro | = 4.0 | No fix listed |
| movabletype movable type pro | = 4.0-beta | No fix listed |
| movabletype movable type pro | = 4.1 | No fix listed |
| movabletype movable type pro | = 4.1-beta | No fix listed |
| movabletype movable type pro | = 4.01-beta | No fix listed |
| movabletype movable type pro | = 4.2 | No fix listed |
| movabletype movable type pro | = 4.2-beta | No fix listed |
| movabletype movable type pro | = 4.3 | No fix listed |
| movabletype movable type pro | = 4.23 | No fix listed |
| movabletype movable type pro | = 4.25 | No fix listed |
| movabletype movable type pro | = 4.26 | No fix listed |
| movabletype movable type pro | = 4.31 | No fix listed |
| movabletype movable type pro | = 4.32 | No fix listed |
| movabletype movable type pro | = 4.33 | No fix listed |
| movabletype movable type pro | = 4.34 | No fix listed |
| movabletype movable type pro | = 4.35 | No fix listed |
| movabletype movable type pro | = 4.36 | No fix listed |
| movabletype movable type pro | = 4.261 | No fix listed |
| movabletype movable type pro | = 4.361 | No fix listed |
| movabletype movable type pro | = 5.1 | No fix listed |
| movabletype movable type pro | = 5.02 | No fix listed |
| movabletype movable type pro | = 5.03 | No fix listed |
| movabletype movable type pro | = 5.04 | No fix listed |
| movabletype movable type pro | = 5.05 | No fix listed |
| movabletype movable type pro | = 5.06 | No fix listed |
| movabletype movable type pro | = 5.11 | No fix listed |
| movabletype movable type pro | = 5.12 | No fix listed |
| movabletype movable type pro | = 5.031 | No fix listed |
| movabletype movable type pro | = 5.051 | No fix listed |
References
- DSA-2423 vendor-advisory
- www.movabletype.org patch vendor-advisory
- www.movabletype.org patch vendor-advisory