CVE-2012-0317: CSRF

Published Mar 3, 2012
·
Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script.

Affected Software

87 affected components
Sixapart Movable Type<=4.37
Sixapart Movable Type=4.28
Sixapart Movable Type=4.29
Sixapart Movable Type=4.36
Sixapart Movable Type=4.291
Sixapart Movable Type=4.292
Sixapart Movable Type=4.361
Sixapart Movable Type=5.0
Sixapart Movable Type=5.01
Sixapart Movable Type=5.1
Sixapart Movable Type=5.02
Sixapart Movable Type=5.04
Sixapart Movable Type=5.05
Sixapart Movable Type=5.06
Sixapart Movable Type=5.11
Sixapart Movable Type=5.12
Sixapart Movable Type=5.051
Sixapart Movable Type<=4.292
Sixapart Movable Type=4.28
Sixapart Movable Type=4.29
Sixapart Movable Type=4.291
Sixapart Movable Type=5.1
Sixapart Movable Type=5.02
Sixapart Movable Type=5.04
Sixapart Movable Type=5.05
Sixapart Movable Type=5.06
Sixapart Movable Type=5.11
Sixapart Movable Type=5.12
Sixapart Movable Type=5.051
Sixapart Movable Type=4.0
Sixapart Movable Type=4.0-beta
Sixapart Movable Type=4.0-beta2
Sixapart Movable Type=4.0-beta3
Sixapart Movable Type=4.0-beta4
Sixapart Movable Type=4.0-beta5
Sixapart Movable Type=4.0-beta6
Sixapart Movable Type=4.0-beta7
Sixapart Movable Type=4.0-rc1
Sixapart Movable Type=4.0-rc2
Sixapart Movable Type=4.0-rc3
Sixapart Movable Type=4.1-beta
Sixapart Movable Type=4.1-beta2
Sixapart Movable Type=4.1-rc1
Sixapart Movable Type=4.2
Sixapart Movable Type=4.2-rc2
Sixapart Movable Type=4.2-rc4
Sixapart Movable Type=4.2-rc5
Sixapart Movable Type=4.12
Sixapart Movable Type=4.15-beta1
Sixapart Movable Type=4.15-beta3
Sixapart Movable Type=4.15-beta4
Sixapart Movable Type=4.22
Sixapart Movable Type=4.23
Sixapart Movable Type=4.24
Sixapart Movable Type=4.25
Sixapart Movable Type=4.26
Sixapart Movable Type=4.27
Sixapart Movable Type=4.28
Sixapart Movable Type=4.29
Sixapart Movable Type=4.35
Sixapart Movable Type=4.36
Sixapart Movable Type=4.37
Sixapart Movable Type=4.261
Sixapart Movable Type=4.291
Sixapart Movable Type=4.292
Sixapart Movable Type=4.361
Sixapart Movable Type=5.0
Sixapart Movable Type=5.0-beta1
Sixapart Movable Type=5.0-beta2
Sixapart Movable Type=5.0-beta3
Sixapart Movable Type=5.0-beta4
Sixapart Movable Type=5.0-rc1
Sixapart Movable Type=5.0-rc2
Sixapart Movable Type=5.0-rc3
Sixapart Movable Type=5.01
Sixapart Movable Type=5.1-beta
Sixapart Movable Type=5.1-rc1
Sixapart Movable Type=5.02
Sixapart Movable Type=5.03
Sixapart Movable Type=5.04
Sixapart Movable Type=5.05
Sixapart Movable Type=5.06
Sixapart Movable Type=5.07
Sixapart Movable Type=5.11
Sixapart Movable Type=5.12
Sixapart Movable Type=5.031
Sixapart Movable Type=5.051

Remediation

Patch Available

http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html

Patch Available

http://www.movabletype.org/documentation/appendices/release-notes/513.html

Event History

Mar 3, 2012
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description

Frequently Asked Questions

1

What is the severity of CVE-2012-0317?

CVE-2012-0317 has a medium severity level due to its potential for gaining unauthorized access through Cross-Site Request Forgery.

2

How do I fix CVE-2012-0317?

To fix CVE-2012-0317, you should upgrade Movable Type to version 4.38, 5.07, or later.

3

Which versions are affected by CVE-2012-0317?

CVE-2012-0317 affects Movable Type versions prior to 4.38, 5.0x before 5.07, and 5.1x before 5.13.

4

What type of vulnerability is CVE-2012-0317?

CVE-2012-0317 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.

5

Can CVE-2012-0317 affect my website?

Yes, if you are using an affected version of Movable Type, your website may be vulnerable to authentication hijacking.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203