Exposição de Movable Type

CMS
14
score de exposição
354
sites usam
0
em exploração
1
críticos
Análise Vexday

Com 24 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, o Movable Type apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que pode refletir tanto a base instalada relativamente menor quanto a maturidade do ciclo de correções. No entanto, o score EPSS de 0,88 associado à CVE-2021-20837 — a falha mais perigosa atualmente rastreada para essa tecnologia — indica alta probabilidade estimada de exploração, exigindo atenção mesmo na ausência de confirmação formal no KEV. O tipo de falha mais recorrente é CWE-94 (injeção de código), categoria que historicamente viabiliza execução remota de comandos e representa risco elevado em ambientes de publicação web. O surgimento de 3 novas CVEs nos últimos 90 dias sugere uma superfície de ataque ainda ativa, e equipes responsáveis por instâncias dessa plataforma devem priorizar a verificação do estado de aplicação de patches, especialmente para a vulnerabilidade de maior EPSS identificada.

CVEs

24 resultados
CVE-2021-20837—Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 rEPSS 88.1%CVE-2020-5577—Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (MovableEPSS 1.7%CVE-2020-5574—HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable TypEPSS 1.2%CVE-2018-0672—Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTEPSS 1.0%CVE-2022-43660HIGHImproper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with PEPSS 1.0%CVE-2020-5575—Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type AdvancedEPSS 0.9%CVE-2021-20814—Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earEPSS 0.9%CVE-2021-20810—Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), EPSS 0.9%CVE-2021-20811—Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), MovaEPSS 0.9%CVE-2021-20808—Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable TypeEPSS 0.9%CVE-2021-20809—Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (MoEPSS 0.9%CVE-2021-20812—Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable TypEPSS 0.9%CVE-2021-20813—Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series)EPSS 0.9%CVE-2021-20815—Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), MoEPSS 0.9%CVE-2020-5576—Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable EPSS 0.8%CVE-2021-20663—Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), MovableEPSS 0.8%CVE-2021-20664—Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable TypEPSS 0.8%CVE-2021-20665—Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), MoEPSS 0.8%CVE-2022-45113MEDIUMImproper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafteEPSS 0.6%CVE-2020-5669—Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier EPSS 0.6%