Read the docs
TI-2012-01310 Aliases CVE-2012-1497GHSA-h855-xgmg-w8p2

The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before…

Priority LOW 21CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.

Why it matters now

EPSS 0.01291 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 120

CPEVersionsRoleVendor
cpe:2.3:a:movabletype:movable_type_open_source:*:*:*:*:*:*:*:*up to 4.37VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.0:*:*:*:*:*:*:*4.0VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.0:beta:*:*:*:*:*:*4.0 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.1:*:*:*:*:*:*:*4.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.1:beta:*:*:*:*:*:*4.1 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.01:beta:*:*:*:*:*:*4.01 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.2:*:*:*:*:*:*:*4.2VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.2:beta:*:*:*:*:*:*4.2 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.3:*:*:*:*:*:*:*4.3VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.23:*:*:*:*:*:*:*4.23VulnerableMovabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:*:*:*:*:*:*:*:* Versions up to 4.37 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.0:beta:*:*:*:*:*:* Versions 4.0 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.1:beta:*:*:*:*:*:* Versions 4.1 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.01:beta:*:*:*:*:*:* Versions 4.01 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.2:beta:*:*:*:*:*:* Versions 4.2 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Movabletype
Show 110 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:movabletype:movable_type_open_source:4.25:*:*:*:*:*:*:*4.25VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.26:*:*:*:*:*:*:*4.26VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.31:*:*:*:*:*:*:*4.31VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.32:*:*:*:*:*:*:*4.32VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.33:*:*:*:*:*:*:*4.33VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.34:*:*:*:*:*:*:*4.34VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.35:*:*:*:*:*:*:*4.35VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.36:*:*:*:*:*:*:*4.36VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.261:*:*:*:*:*:*:*4.261VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:4.361:*:*:*:*:*:*:*4.361VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.1:*:*:*:*:*:*:*5.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.02:*:*:*:*:*:*:*5.02VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.03:*:*:*:*:*:*:*5.03VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.04:*:*:*:*:*:*:*5.04VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.05:*:*:*:*:*:*:*5.05VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.06:*:*:*:*:*:*:*5.06VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.11:*:*:*:*:*:*:*5.11VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.12:*:*:*:*:*:*:*5.12VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.031:*:*:*:*:*:*:*5.031VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_open_source:5.051:*:*:*:*:*:*:*5.051VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:*:*:*:*:*:*:*:*up to 4.37VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.0:*:*:*:*:*:*:*4.0VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.0:beta:*:*:*:*:*:*4.0 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.1:*:*:*:*:*:*:*4.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.01:beta:*:*:*:*:*:*4.01 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.1:beta:*:*:*:*:*:*4.1 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.2:*:*:*:*:*:*:*4.2VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.2:beta:*:*:*:*:*:*4.2 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.3:*:*:*:*:*:*:*4.3VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.23:*:*:*:*:*:*:*4.23VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.25:*:*:*:*:*:*:*4.25VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.26:*:*:*:*:*:*:*4.26VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.31:*:*:*:*:*:*:*4.31VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.32:*:*:*:*:*:*:*4.32VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.33:*:*:*:*:*:*:*4.33VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.34:*:*:*:*:*:*:*4.34VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.35:*:*:*:*:*:*:*4.35VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.36:*:*:*:*:*:*:*4.36VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.261:*:*:*:*:*:*:*4.261VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:4.361:*:*:*:*:*:*:*4.361VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.1:*:*:*:*:*:*:*5.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.02:*:*:*:*:*:*:*5.02VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.03:*:*:*:*:*:*:*5.03VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.04:*:*:*:*:*:*:*5.04VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.05:*:*:*:*:*:*:*5.05VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.06:*:*:*:*:*:*:*5.06VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.11:*:*:*:*:*:*:*5.11VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.12:*:*:*:*:*:*:*5.12VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.031:*:*:*:*:*:*:*5.031VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_enterprise:5.051:*:*:*:*:*:*:*5.051VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:*:*:*:*:*:*:*:*up to 4.37VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.0:*:*:*:*:*:*:*4.0VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.0:beta:*:*:*:*:*:*4.0 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.1:*:*:*:*:*:*:*4.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.01:beta:*:*:*:*:*:*4.01 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.1:beta:*:*:*:*:*:*4.1 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.2:*:*:*:*:*:*:*4.2VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.2:beta:*:*:*:*:*:*4.2 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.3:*:*:*:*:*:*:*4.3VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.23:*:*:*:*:*:*:*4.23VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.25:*:*:*:*:*:*:*4.25VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.26:*:*:*:*:*:*:*4.26VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.31:*:*:*:*:*:*:*4.31VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.32:*:*:*:*:*:*:*4.32VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.33:*:*:*:*:*:*:*4.33VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.34:*:*:*:*:*:*:*4.34VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.35:*:*:*:*:*:*:*4.35VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.36:*:*:*:*:*:*:*4.36VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.261:*:*:*:*:*:*:*4.261VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:4.361:*:*:*:*:*:*:*4.361VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.1:*:*:*:*:*:*:*5.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.02:*:*:*:*:*:*:*5.02VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.03:*:*:*:*:*:*:*5.03VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.04:*:*:*:*:*:*:*5.04VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.05:*:*:*:*:*:*:*5.05VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.06:*:*:*:*:*:*:*5.06VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.11:*:*:*:*:*:*:*5.11VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.12:*:*:*:*:*:*:*5.12VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.031:*:*:*:*:*:*:*5.031VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_advanced:5.051:*:*:*:*:*:*:*5.051VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:*:*:*:*:*:*:*:*up to 4.37VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.0:*:*:*:*:*:*:*4.0VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.0:beta:*:*:*:*:*:*4.0 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.1:*:*:*:*:*:*:*4.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.1:beta:*:*:*:*:*:*4.1 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.01:beta:*:*:*:*:*:*4.01 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.2:*:*:*:*:*:*:*4.2VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.2:beta:*:*:*:*:*:*4.2 betaVulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.3:*:*:*:*:*:*:*4.3VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.23:*:*:*:*:*:*:*4.23VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.25:*:*:*:*:*:*:*4.25VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.26:*:*:*:*:*:*:*4.26VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.31:*:*:*:*:*:*:*4.31VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.32:*:*:*:*:*:*:*4.32VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.33:*:*:*:*:*:*:*4.33VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.34:*:*:*:*:*:*:*4.34VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.35:*:*:*:*:*:*:*4.35VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.36:*:*:*:*:*:*:*4.36VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.261:*:*:*:*:*:*:*4.261VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:4.361:*:*:*:*:*:*:*4.361VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.1:*:*:*:*:*:*:*5.1VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.02:*:*:*:*:*:*:*5.02VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.03:*:*:*:*:*:*:*5.03VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.04:*:*:*:*:*:*:*5.04VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.05:*:*:*:*:*:*:*5.05VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.06:*:*:*:*:*:*:*5.06VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.11:*:*:*:*:*:*:*5.11VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.12:*:*:*:*:*:*:*5.12VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.031:*:*:*:*:*:*:*5.031VulnerableMovabletype
cpe:2.3:a:movabletype:movable_type_pro:5.051:*:*:*:*:*:*:*5.051VulnerableMovabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.36:*:*:*:*:*:*:* Versions 4.36 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.261:*:*:*:*:*:*:* Versions 4.261 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:4.361:*:*:*:*:*:*:* Versions 4.361 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.02:*:*:*:*:*:*:* Versions 5.02 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.03:*:*:*:*:*:*:* Versions 5.03 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.05:*:*:*:*:*:*:* Versions 5.05 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.06:*:*:*:*:*:*:* Versions 5.06 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.11:*:*:*:*:*:*:* Versions 5.11 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.12:*:*:*:*:*:*:* Versions 5.12 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.031:*:*:*:*:*:*:* Versions 5.031 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_open_source:5.051:*:*:*:*:*:*:* Versions 5.051 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:*:*:*:*:*:*:*:* Versions up to 4.37 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.0:beta:*:*:*:*:*:* Versions 4.0 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.01:beta:*:*:*:*:*:* Versions 4.01 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.1:beta:*:*:*:*:*:* Versions 4.1 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.2:beta:*:*:*:*:*:* Versions 4.2 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.36:*:*:*:*:*:*:* Versions 4.36 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.261:*:*:*:*:*:*:* Versions 4.261 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:4.361:*:*:*:*:*:*:* Versions 4.361 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.02:*:*:*:*:*:*:* Versions 5.02 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.03:*:*:*:*:*:*:* Versions 5.03 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.05:*:*:*:*:*:*:* Versions 5.05 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.06:*:*:*:*:*:*:* Versions 5.06 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.11:*:*:*:*:*:*:* Versions 5.11 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.12:*:*:*:*:*:*:* Versions 5.12 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.031:*:*:*:*:*:*:* Versions 5.031 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_enterprise:5.051:*:*:*:*:*:*:* Versions 5.051 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:*:*:*:*:*:*:*:* Versions up to 4.37 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.0:beta:*:*:*:*:*:* Versions 4.0 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.01:beta:*:*:*:*:*:* Versions 4.01 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.1:beta:*:*:*:*:*:* Versions 4.1 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.2:beta:*:*:*:*:*:* Versions 4.2 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.36:*:*:*:*:*:*:* Versions 4.36 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.261:*:*:*:*:*:*:* Versions 4.261 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:4.361:*:*:*:*:*:*:* Versions 4.361 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.02:*:*:*:*:*:*:* Versions 5.02 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.03:*:*:*:*:*:*:* Versions 5.03 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.05:*:*:*:*:*:*:* Versions 5.05 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.06:*:*:*:*:*:*:* Versions 5.06 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.11:*:*:*:*:*:*:* Versions 5.11 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.12:*:*:*:*:*:*:* Versions 5.12 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.031:*:*:*:*:*:*:* Versions 5.031 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_advanced:5.051:*:*:*:*:*:*:* Versions 5.051 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:*:*:*:*:*:*:*:* Versions up to 4.37 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.0:beta:*:*:*:*:*:* Versions 4.0 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.1:beta:*:*:*:*:*:* Versions 4.1 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.01:beta:*:*:*:*:*:* Versions 4.01 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.2:beta:*:*:*:*:*:* Versions 4.2 beta Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.36:*:*:*:*:*:*:* Versions 4.36 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.261:*:*:*:*:*:*:* Versions 4.261 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:4.361:*:*:*:*:*:*:* Versions 4.361 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.02:*:*:*:*:*:*:* Versions 5.02 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.03:*:*:*:*:*:*:* Versions 5.03 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.05:*:*:*:*:*:*:* Versions 5.05 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.06:*:*:*:*:*:*:* Versions 5.06 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.11:*:*:*:*:*:*:* Versions 5.11 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.12:*:*:*:*:*:*:* Versions 5.12 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.031:*:*:*:*:*:*:* Versions 5.031 Vulnerable ·Movabletype
  • cpe:2.3:a:movabletype:movable_type_pro:5.051:*:*:*:*:*:*:* Versions 5.051 Vulnerable ·Movabletype

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-1497
  2. 2026-10-03 Alias added: GHSA-h855-xgmg-w8p2

References

Patch 2

Advisory 1

  • TI-2012-00306 The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before… CVSS 2.0MEDIUM 6.5
  • TI-2021-03892 Cross-site scripting in Six Apart Ltd. Movable Type CVSS 3.1MEDIUM 6.1
  • TI-2021-03891 Cross-site scripting in Six Apart Ltd. Movable Type CVSS 3.1MEDIUM 6.1
  • TI-2021-03890 Cross-site scripting in Six Apart Ltd. Movable Type CVSS 3.1MEDIUM 6.1
  • TI-2012-01159 Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type… CVSS 2.0MEDIUM 4.3
  • TI-2012-00305 Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences