TI-2008-04417 Aliases CVE-2008-4634 GHSA-g2w4-8qwh-vwpr

Cross-site scripting (XSS) vulnerability in Movable Type 4 through 4.21 allows remote…

LOW 19CWE-79Published 2008-10-21 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Partial · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in Movable Type 4 through 4.21 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the administrative page, a different vulnerability than CVE-2008-4079.

Why it matters now

EPSS 0.01019 63rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:six_apart:movable_type:4:::::::*	4	Vulnerable	Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4:unknown:community_solution:::::*	4 unknown	Vulnerable	Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4:unknown:enterprise:::::*	4 unknown	Vulnerable	Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4:unknown:open_source:::::*	4 unknown	Vulnerable	Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:::::::*	4.20	Vulnerable	Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:unknown:community_solution:::::*	4.20 unknown	Vulnerable	Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:unknown:enterprise:::::*	4.20 unknown	Vulnerable	Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:unknown:open_source:::::*	4.20 unknown	Vulnerable	Six Apart Ltd.

cpe:2.3:a:six_apart:movable_type:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4:unknown:community_solution:*:*:*:*:* Versions 4 unknown Vulnerable ·Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4:unknown:enterprise:*:*:*:*:* Versions 4 unknown Vulnerable ·Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4:unknown:open_source:*:*:*:*:* Versions 4 unknown Vulnerable ·Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:*:*:*:*:*:*:* Versions 4.20 Vulnerable ·Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:unknown:community_solution:*:*:*:*:* Versions 4.20 unknown Vulnerable ·Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:unknown:enterprise:*:*:*:*:* Versions 4.20 unknown Vulnerable ·Six Apart Ltd.
cpe:2.3:a:six_apart:movable_type:4.20:unknown:open_source:*:*:*:*:* Versions 4.20 unknown Vulnerable ·Six Apart Ltd.

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2008-4634
2026-10-03 Alias added: GHSA-g2w4-8qwh-vwpr

References

Advisory 2

Other 1

http://www.sixapart.jp/movabletype/news/2008/10/15-1400.html

TI-2007-00224 Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is… CVSS 2.0MEDIUM 6.8
TI-2003-00268 Cross-site scripting (XSS) vulnerability in Movable Type before 2.6, and possibly other… CVSS 2.0MEDIUM 6.8
TI-2009-02369 mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not… CVSS 2.0MEDIUM 5.8
TI-2005-02932 The password reset feature in Movable Type before 3.2 generates different error messages… CVSS 2.0MEDIUM 5.0
TI-2008-05514 Cross-site scripting (XSS) vulnerability in Six Apart Movable Type Enterprise (MTE) 1.x… CVSS 2.0MEDIUM 4.3
TI-2006-04896 Cross-site scripting (XSS) vulnerability in the search function in Six Apart Movable Type… CVSS 2.0MEDIUM 4.3

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences