Main Vulnerability Database Vulnerabilities #VU66754

OS Command Injection in Six Apart Ltd products - CVE-2022-38078

Published: August 25, 2022

Vulnerability identifier: #VU66754

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-38078

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the Movable Type XMLRPC API. A remote unauthenticated attacker can send a specially crafted message and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Movable Type
Movable Type Premium Advanced
Movable Type Advanced
Movable Type Premium

How to mitigate CVE-2022-38078

Install updates from vendor's website.

Movable Type - addressed in versions r.5301, 6.8.7
Movable Type Premium Advanced - update to 1.53
Movable Type Advanced - addressed in versions r.5301, 6.8.7
Movable Type Premium - update to 1.53

External References

Related Security Bulletins