Executive Summary

Informations
NameCVE-2008-5845First vendor Publication2009-01-05
VendorCveLast vendor Modification2011-09-06

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score4.3Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score8.6AuthentificationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5845

CWE : Common Weakness Enumeration

idName
CWE-79Failure to Preserve Web Page Structure ('Cross-site Scripting')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application17

Open Source Vulnerability Database (OSVDB)

idDescription
53475Movable Type Community Blog Template User Archive Name XSS
53474Movable Type Trackback Title XSS
53473Movable Type CMS App Multiple Screen XSS
53472Movable Type Profile View Template Multiple Field XSS

Internal Sources (Detail)

SourceUrl
CONFIRMhttp://www.movabletype.org/mt_423_change_log.html
JVNhttp://jvn.jp/en/jp/JVN45658190/index.html
JVNDBhttp://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000031.html

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2013-05-11 00:34:01
  • Multiple Updates