| Package | Affected versions | Patched versions |
|---|---|---|
| movable type advanced | = 4.0= 4.01= 4.1= 4.2= 4.23= 4.25= 4.26= 4.261= 4.3= 4.31= 4.32= 4.33= 4.34= 4.35= 4.36= 4.361= 5.02= 5.03= 5.031= 5.04= 5.05= 5.051= 5.06= 5.1= 5.11= 5.12≤ 4.37 | |
| movable type enterprise | = 4.0= 4.01= 4.1= 4.2= 4.23= 4.25= 4.26= 4.261= 4.3= 4.31= 4.32= 4.33= 4.34= 4.35= 4.36= 4.361= 5.02= 5.03= 5.031= 5.04= 5.05= 5.051= 5.06= 5.1= 5.11= 5.12≤ 4.37 | |
| movable type open source | = 4.0= 4.01= 4.1= 4.2= 4.23= 4.25= 4.26= 4.261= 4.3= 4.31= 4.32= 4.33= 4.34= 4.35= 4.36= 4.361= 5.02= 5.03= 5.031= 5.04= 5.05= 5.051= 5.06= 5.1= 5.11= 5.12≤ 4.37 | |
| movable type pro | = 4.0= 4.01= 4.1= 4.2= 4.23= 4.25= 4.26= 4.261= 4.3= 4.31= 4.32= 4.33= 4.34= 4.35= 4.36= 4.361= 5.02= 5.03= 5.031= 5.04= 5.05= 5.051= 5.06= 5.1= 5.11= 5.12≤ 4.37 |
The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free