CVE-2021-20837observed exploitation

CVE-2021-20837: vulnerability in Six Apart Ltd. Movable Type

Published · Updated

Follow this CVE+ Monitor Movable Type

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

84Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 88%
from disclosure to weaponsame day
Published on NVDOct 26
1st PoCOct 25
VulnCheck+217d
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
Affected products
Six Apart Ltd. · Movable Type
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Six Apart Ltd. Movable Type

In the same product, most dangerous first.

CVE-2020-5577—CVE-2020-5577EPSS 1.7%CVE-2020-5574—CVE-2020-5574EPSS 1.2%CVE-2022-43660HIGHCVE-2022-43660EPSS 1.0%CVE-2020-5575—CVE-2020-5575EPSS 0.9%CVE-2021-20814—CVE-2021-20814EPSS 0.9%CVE-2021-20810—CVE-2021-20810EPSS 0.9%