CVE-2008-5845: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template.
Affected Software
Event History
Frequently Asked Questions
What are the potential impacts of CVE-2008-5845?
CVE-2008-5845 allows remote attackers to execute arbitrary web scripts or HTML, leading to cross-site scripting attacks that can compromise user data and trust.
Which versions of Movable Type are affected by CVE-2008-5845?
CVE-2008-5845 affects Movable Type versions prior to 4.23 and multiple earlier versions including 3.0d through 4.21.
How can I mitigate the risks associated with CVE-2008-5845?
To mitigate CVE-2008-5845, you should upgrade to Movable Type version 4.23 or later, where the vulnerabilities have been patched.
What are the common attack vectors associated with CVE-2008-5845?
Common attack vectors for CVE-2008-5845 include injecting malicious scripts through the MTEntryAuthorUsername, MTAuthorDisplayName, MTEntryAuthorDisplayName, or MTCommenterName fields.
Is there any public disclosure of CVE-2008-5845?
Yes, CVE-2008-5845 has been publicly disclosed and detailed through various security advisories and logs regarding Movable Type vulnerabilities.