Unscored severity · published Jan 13, 2007
CVE-2007-0231
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
Movable Type · Six Apart
3.33 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0231
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0231
Vendor Advisory
http://golem.ph.utexas.edu/~distler/blog/archives/001102.html
osvdb.org
http://osvdb.org/32717
secunia.com
http://secunia.com/advisories/23669
www.vupen.com
http://www.vupen.com/english/advisories/2007/0142
Vendor Advisory
http://www.zackvision.com/weblog/2007/01/movabletype-security-bug.html
More from Movable Type
–
CVE-2009-2492
Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified…
–
CVE-2009-2481
mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to…
–
CVE-2008-5808
Cross-site scripting (XSS) vulnerability in Six Apart Movable Type Enterprise (MTE) 1.x before 1.56; Movable Type (MT) 3.x before 3.38; and Movable Type, Movable Type Open Source…
–
CVE-2008-4634
Cross-site scripting (XSS) vulnerability in Movable Type 4 through 4.21 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the…
–
CVE-2008-4079
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and earlier; and Movable…