| Package | Affected versions | Patched versions |
|---|---|---|
| movable type | = 3.01d= 3.0d= 3.1= 3.11= 3.12= 3.14= 3.15= 3.16= 3.17= 3.2= 3.3= 3.32= 3.33= 3.34= 3.35= 4.2≤ 4.21 |
Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free