CVE-2011-5084

Published: Apr 2, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected (55)

Products: Sixapart: Movable Type

Sixapart

1 product

Movable Type

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Sixapart Movable Type	Version 4.01
Sixapart Movable Type	Version 4.01 beta2
Sixapart Movable Type	Version 4.01 beta
Sixapart Movable Type	Version 4.01 rc1
Sixapart Movable Type	Version 4.0
Sixapart Movable Type	Version 4.0 beta2
Sixapart Movable Type	Version 4.0 beta3
Sixapart Movable Type	Version 4.0 beta4
Sixapart Movable Type	Version 4.0 beta5
Sixapart Movable Type	Version 4.0 beta6
Sixapart Movable Type	Version 4.0 beta7
Sixapart Movable Type	Version 4.0 beta
Sixapart Movable Type	Version 4.0 rc1
Sixapart Movable Type	Version 4.0 rc2
Sixapart Movable Type	Version 4.0 rc3
Sixapart Movable Type	Version 4.12
Sixapart Movable Type	Version 4.15 beta1
Sixapart Movable Type	Version 4.15 beta3
Sixapart Movable Type	Version 4.15 beta4
Sixapart Movable Type	Version 4.1
Sixapart Movable Type	Version 4.1 beta2
Sixapart Movable Type	Version 4.1 beta
Sixapart Movable Type	Version 4.1 rc1
Sixapart Movable Type	Version 4.21
Sixapart Movable Type	Version 4.22
Sixapart Movable Type	Version 4.23
Sixapart Movable Type	Version 4.24
Sixapart Movable Type	Version 4.25
Sixapart Movable Type	Version 4.261
Sixapart Movable Type	Version 4.26
Sixapart Movable Type	Version 4.27
Sixapart Movable Type	Version 4.28
Sixapart Movable Type	Version 4.291
Sixapart Movable Type	Version 4.292
Sixapart Movable Type	Version 4.29
Sixapart Movable Type	Version 4.2
Sixapart Movable Type	Version 4.2 rc2
Sixapart Movable Type	Version 4.2 rc4
Sixapart Movable Type	Version 4.2 rc5
Sixapart Movable Type	Version 4.35
Sixapart Movable Type	Version 4.36

Configuration B

14 vulnerable

Vulnerable Software	Affected Versions
Sixapart Movable Type	Version 5.01
Sixapart Movable Type	Version 5.02
Sixapart Movable Type	Version 5.031
Sixapart Movable Type	Version 5.03
Sixapart Movable Type	Version 5.04
Sixapart Movable Type	Version 5.05
Sixapart Movable Type	Version 5.0
Sixapart Movable Type	Version 5.0 beta1
Sixapart Movable Type	Version 5.0 beta2
Sixapart Movable Type	Version 5.0 beta3
Sixapart Movable Type	Version 5.0 beta4
Sixapart Movable Type	Version 5.0 rc1
Sixapart Movable Type	Version 5.0 rc2
Sixapart Movable Type	Version 5.0 rc3

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://www.debian.org/security/2012/dsa-2423

Source: cve@mitre.org

http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.debian.org/security/2012/dsa-2423

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.