CVE-2008-5845

Published: Jan 5, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template.

Affected (17)

Products: Sixapart: Movable Type

Sixapart

1 product

Movable Type

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Sixapart Movable Type	Up to 4.21
Sixapart Movable Type	Version 3.01d
Sixapart Movable Type	Version 3.0d
Sixapart Movable Type	Version 3.11
Sixapart Movable Type	Version 3.12
Sixapart Movable Type	Version 3.14
Sixapart Movable Type	Version 3.15
Sixapart Movable Type	Version 3.16
Sixapart Movable Type	Version 3.17
Sixapart Movable Type	Version 3.1
Sixapart Movable Type	Version 3.2
Sixapart Movable Type	Version 3.32
Sixapart Movable Type	Version 3.33
Sixapart Movable Type	Version 3.34
Sixapart Movable Type	Version 3.35
Sixapart Movable Type	Version 3.3
Sixapart Movable Type	Version 4.2