← back
CVE-2021-20837observed exploitation

CVE-2021-20837

84Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 88%
from disclosure to weapon0 days
Published on NVDOct 26
1st PoCOct 25
VulnCheck+217d
exploitation probability
88%top 1% of all CVEs
observed exploitation
yesVulnCheck
10 public exploit(s)
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
Affected products
Six Apart Ltd. · Movable Type
public PoCs found — 10✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/50464githubgithub.com/orangmuda/CVE-2021-20837★ 21githubgithub.com/ghost-nemesis/cve-2021-20837-poc★ 18githubgithub.com/Cosemz/CVE-2021-20837★ 0vulncheckvulncheck.com/xdb/12f546abe7daunverifiedvulncheckvulncheck.com/xdb/24823bc41307unverifiedvulncheckvulncheck.com/xdb/569180ea1a2dunverifiedcve_referencepacketstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.htmlunverifiedcve_referencepacketstormsecurity.com/files/164705/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.htmlunverifiedvulncheckvulncheck.com/xdb/cbc71743bd9eunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/164705/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.htmlhttp://packetstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.htmlhttps://jvn.jp/en/jp/JVN41119755/index.htmlhttps://movabletype.org/news/2021/10/mt-782-683-released.html