Description

Movable Type versions <= 6.0.6 and <= 5.2.11 are susceptible to LFI (local file inclusion) attacks due to a vulnerability of Storable perl module. It allows an attacker to include a file and run any perl script the web server.

Remediation

Upgrade to the latest version of Movable Type. Movable Type 5.0x and 5.1x has reached End of Life and is no longer supported. For users that are running any version of 5.0x and 5.1x, please upgrade to Movable Type 5.2.12.

References

Movable Type 6.0.7 And 5.2.12 Released To Close Security Vulnerability

Related Vulnerabilities

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-26477)

Ektron CMS unauthenticated code execution and Local File Read

Oracle WebLogic Remote Code Execution via T3

WordPress Plugin BackWPup Remote and Local Code Execution (1.6.1)

WordPress Plugin PropertyHive Remote Code Execution (1.4.25)

Severity

High

Classification

CVE-2015-1592 CWE-94 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Code Execution Configuration