Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
NameCVE-2008-5845First vendor Publication2009-01-05
VendorCveLast vendor Modification2011-09-06

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score4.3Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores


Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5845

CWE : Common Weakness Enumeration

100 %CWE-79Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

CPE : Common Platform Enumeration


Open Source Vulnerability Database (OSVDB)

53475Movable Type Community Blog Template User Archive Name XSS
53474Movable Type Trackback Title XSS
53473Movable Type CMS App Multiple Screen XSS
53472Movable Type Profile View Template Multiple Field XSS

Sources (Detail)

CONFIRM http://www.movabletype.org/mt_423_change_log.html
JVN http://jvn.jp/en/jp/JVN45658190/index.html
JVNDB http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000031.html

Alert History

If you want to see full details history, please login or register.
2016-04-26 18:12:05
  • Multiple Updates
2013-05-11 00:34:01
  • Multiple Updates