A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Movable Type (Software Edition)
Vendor
Six Apart Ltd.
Product
Movable Type (Software Edition)
Platforms
Unknown
Default status
Unknown
Movable Type (Software Edition) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
9.0.4 to 9.0.5 (9.0 series)
affected
Unavailable
Unavailable
Unavailable
None listed
8.8.0 to 8.8.1 (8.8 series)
affected
Unavailable
Unavailable
Unavailable
None listed
8.0.2 to 8.0.8 (8.0 series)
affected
Unavailable
Unavailable
Unavailable
None listed
Movable Type Advanced (Software Edition)
Vendor
Six Apart Ltd.
Product
Movable Type Advanced (Software Edition)
Platforms
Unknown
Default status
Unknown
Movable Type Advanced (Software Edition) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
9.0.4 to 9.0.5 (9.0 series)
affected
Unavailable
Unavailable
Unavailable
None listed
8.8.0 to 8.8.1 (8.8 series)
affected
Unavailable
Unavailable
Unavailable
None listed
8.0.2 to 8.0.8 (8.0 series)
affected
Unavailable
Unavailable
Unavailable
None listed
Movable Type Premium (Software Edition)
Vendor
Six Apart Ltd.
Product
Movable Type Premium (Software Edition)
Platforms
Unknown
Default status
Unknown
Movable Type Premium (Software Edition) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
9.0.4 (MTP 9.0 series)
affected
Unavailable
Unavailable
Unavailable
None listed
2.13 and earlier (MTP 2 series)
affected
Unavailable
Unavailable
Unavailable
None listed
Movable Type Premium (Advanced Edition) (Software Edition)
Vendor
Six Apart Ltd.
Product
Movable Type Premium (Advanced Edition) (Software Edition)
Platforms
Unknown
Default status
Unknown
Movable Type Premium (Advanced Edition) (Software Edition) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
9.0.4 (MTP 9.0 series)
affected
Unavailable
Unavailable
Unavailable
None listed
2.13 and earlier (MTP 2 series)
affected
Unavailable
Unavailable
Unavailable
None listed
Movable Type (Cloud Edition)
Vendor
Six Apart Ltd.
Product
Movable Type (Cloud Edition)
Platforms
Unknown
Default status
Unknown
Movable Type (Cloud Edition) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
9.0.5 (9 series)
affected
Unavailable
Unavailable
Unavailable
None listed
8.8.1 (8 series)
affected
Unavailable
Unavailable
Unavailable
None listed
Movable Type Premium (Cloud Edition)
Vendor
Six Apart Ltd.
Product
Movable Type Premium (Cloud Edition)
Platforms
Unknown
Default status
Unknown
Movable Type Premium (Cloud Edition) · Scoped product and version facts