ID:3747 - Exploit for Improper Neutralization of Special Elements in Output Used by a Downstream Component in Movable Type - CVE-2015-1592

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Exploits ID:3747 - Exploit for Improper Neutralization of Special Elements in Output Used by a Downstream Component in Movable Type - CVE-2015-1592

ID:3747 - Exploit for Improper Neutralization of Special Elements in Output Used by a Downstream Component in Movable Type - CVE-2015-1592

Published: August 9, 2020


Vulnerability identifier: #VU40885
Vulnerability risk: Medium
CVE-ID: CVE-2015-1592
CWE-ID: CWE-74
Exploitation vector: Remote access
Vulnerable software:
Movable Type

Link to public exploit:


Vulnerability description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.


Remediation

Install update from vendor's website.