CVE-2009-2481: Medium severity movable type vulnerability
Published Jul 16, 2009
·Updated
mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors.
Affected Software
57 affected components
Six Apart Movable Type=1.54
Six Apart Movable Type=2.6
Six Apart Movable Type=2.63
Six Apart Movable Type=3.3
Six Apart Movable Type=3.16
Six Apart Movable Type=3.17
Six Apart Movable Type=3.32
Six Apart Movable Type=3.33
Six Apart Movable Type=3.36
Six Apart Movable Type=4.20
Six Apart Movable Type=4.20
Six Apart Movable Type=4.20
Six Apart Movable Type=4.20
Six Apart Movable Type=4.25
Sixapart Movable Type<=4.26
Sixapart Movable Type=1.00
Sixapart Movable Type=1.1
Sixapart Movable Type=1.2
Sixapart Movable Type=1.3
Sixapart Movable Type=1.4
Sixapart Movable Type=1.5
Sixapart Movable Type=1.31
Sixapart Movable Type=3.0d
Sixapart Movable Type=3.1
Sixapart Movable Type=3.01d
Sixapart Movable Type=3.2
Sixapart Movable Type=3.3
Sixapart Movable Type=3.11
Sixapart Movable Type=3.12
Sixapart Movable Type=3.14
Sixapart Movable Type=3.15
Sixapart Movable Type=3.16
Sixapart Movable Type=3.17
Sixapart Movable Type=3.32
Sixapart Movable Type=3.33
Sixapart Movable Type=3.34
Sixapart Movable Type=3.35
Sixapart Movable Type=4.0
Sixapart Movable Type=4.0
Sixapart Movable Type=4.01
Sixapart Movable Type=4.1
Sixapart Movable Type=4.1
Sixapart Movable Type=4.01
Sixapart Movable Type=4.01-b
Sixapart Movable Type=4.01-b
Sixapart Movable Type=4.2
Sixapart Movable Type=4.2
Sixapart Movable Type=4.2
Sixapart Movable Type=4.12
Sixapart Movable Type=4.12
Sixapart Movable Type=4.21
Sixapart Movable Type=4.21
Sixapart Movable Type=4.21
Sixapart Movable Type=4.23
Sixapart Movable Type=4.23
Sixapart Movable Type=4.23
Sixapart Movable Type=4.25
Remediation
Patch Available
Patch Available
Event History
Jul 16, 2009
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2481?
CVE-2009-2481 has been classified with a moderate severity level due to its ability to bypass access restrictions.
2
How do I fix CVE-2009-2481?
To resolve CVE-2009-2481, upgrade to Movable Type version 4.261 or later.
3
What versions are affected by CVE-2009-2481?
CVE-2009-2481 affects multiple versions of Movable Type up to 4.260, including versions 1.0 to 4.260.
4
What can attackers do with CVE-2009-2481?
Attackers exploiting CVE-2009-2481 can send emails to arbitrary addresses or obtain sensitive information.
5
Is CVE-2009-2481 a remote vulnerability?
Yes, CVE-2009-2481 allows remote attackers to exploit the vulnerability without any local access.