CVE-2003-0287: XSS
Cross-site scripting (XSS) vulnerability in Movable Type before 2.6, and possibly other versions including 2.63, allows remote attackers to insert arbitrary web script or HTML via the Name textbox, possibly when the "Allow HTML in comments?" option is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Movable Typeto a version that resolves this vulnerability.Fixed in 2.6 - Configuration
Disable the 'Allow HTML in comments?' option to prevent arbitrary HTML/script being submitted via the Name textbox.
Movable Type Allow HTML in comments? = false
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0287?
CVE-2003-0287 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2003-0287?
To fix CVE-2003-0287, upgrade Movable Type to version 2.63 or later, which includes a patch for this vulnerability.
What is the impact of CVE-2003-0287?
The impact of CVE-2003-0287 allows remote attackers to execute arbitrary web scripts or HTML in the context of users visiting the affected site.
Which versions of Movable Type are affected by CVE-2003-0287?
Movable Type versions prior to 2.6 and possibly 2.63 are affected by CVE-2003-0287.
How can I mitigate the risk of CVE-2003-0287?
Mitigating the risk of CVE-2003-0287 includes disabling HTML in comments and applying necessary software updates as recommended.