CVE-2023-45746

Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script

Medium · published October 30, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Published
2023-10-30T04:57Z
EPSS history
Timeline
  • 30 OCT 04:57Z
    Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script
    cvelistv5