CVE-2025-24841: fallo de gravedad media en Six Apart Ltd. Movable Type (8.0.x series)
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.2%
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Six Apart Ltd. · Movable Type (8.0.x series)Six Apart Ltd. · Movable Type (8.4.x series)Six Apart Ltd. · Movable Type Advanced (8.0.x series)Six Apart Ltd. · Movable Type Advanced (8.4.x series)Six Apart Ltd. · Movable Type Cloud Edition (8.x series)Six Apart Ltd. · Movable Type Premium (2.x series)Six Apart Ltd. · Movable Type Premium (Advanced Edition) (2.x series)Six Apart Ltd. · Movable Type Premium Cloud Edition (2.x series)CVEs relacionadas — Six Apart Ltd. Movable Type (8.0.x series)
En el mismo producto, de las más peligrosas a las menos.