CVE-2012-1262

Sažetak

Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.

Reference

http://jvn.jp/en/jp/JVN49836527/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016
http://osvdb.org/79470
http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2012/Feb/407
http://www.debian.org/security/2012/dsa-2423
http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html
http://www.movabletype.org/documentation/appendices/release-notes/513.html
http://www.securityfocus.com/bid/52138
http://www.securitytracker.com/id?1026738
https://exchange.xforce.ibmcloud.com/vulnerabilities/73411
https://exchange.xforce.ibmcloud.com/vulnerabilities/73480
https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt

CVSS

Base:	4.3
Impact:	2.9
Exploitability:	8.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	MEDIUM	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
NONE	PARTIAL	NONE

CVSS vektor

AV:N/AC:M/Au:N/C:N/I:P/A:N

Zadnje važnije ažuriranje

18-01-2018 - 02:29

Objavljeno

03-03-2012 - 04:04