CVE-2012-1262: XSS
First published: Sat Mar 03 2012(Updated: )
Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Movable Type Open Source | <=4.37 | |
| Movable Type Open Source | =4.0 | |
| Movable Type Open Source | =4.0-beta | |
| Movable Type Open Source | =4.1 | |
| Movable Type Open Source | =4.1-beta | |
| Movable Type Open Source | =4.01-beta | |
| Movable Type Open Source | =4.2 | |
| Movable Type Open Source | =4.2-beta | |
| Movable Type Open Source | =4.3 | |
| Movable Type Open Source | =4.23 | |
| Movable Type Open Source | =4.25 | |
| Movable Type Open Source | =4.26 | |
| Movable Type Open Source | =4.31 | |
| Movable Type Open Source | =4.32 | |
| Movable Type Open Source | =4.33 | |
| Movable Type Open Source | =4.34 | |
| Movable Type Open Source | =4.35 | |
| Movable Type Open Source | =4.36 | |
| Movable Type Open Source | =4.261 | |
| Movable Type Open Source | =4.361 | |
| Movable Type Open Source | =5.1 | |
| Movable Type Open Source | =5.02 | |
| Movable Type Open Source | =5.03 | |
| Movable Type Open Source | =5.04 | |
| Movable Type Open Source | =5.05 | |
| Movable Type Open Source | =5.06 | |
| Movable Type Open Source | =5.11 | |
| Movable Type Open Source | =5.12 | |
| Movable Type Open Source | =5.031 | |
| Movable Type Open Source | =5.051 | |
| Movable Type | <=4.37 | |
| Movable Type | =4.0 | |
| Movable Type | =4.0-beta | |
| Movable Type | =4.1 | |
| Movable Type | =4.01-beta | |
| Movable Type | =4.1-beta | |
| Movable Type | =4.2 | |
| Movable Type | =4.2-beta | |
| Movable Type | =4.3 | |
| Movable Type | =4.23 | |
| Movable Type | =4.25 | |
| Movable Type | =4.26 | |
| Movable Type | =4.31 | |
| Movable Type | =4.32 | |
| Movable Type | =4.33 | |
| Movable Type | =4.34 | |
| Movable Type | =4.35 | |
| Movable Type | =4.36 | |
| Movable Type | =4.261 | |
| Movable Type | =4.361 | |
| Movable Type | =5.1 | |
| Movable Type | =5.02 | |
| Movable Type | =5.03 | |
| Movable Type | =5.04 | |
| Movable Type | =5.05 | |
| Movable Type | =5.06 | |
| Movable Type | =5.11 | |
| Movable Type | =5.12 | |
| Movable Type | =5.031 | |
| Movable Type | =5.051 | |
| Movable Type | <=4.37 | |
| Movable Type | =4.0 | |
| Movable Type | =4.0-beta | |
| Movable Type | =4.1 | |
| Movable Type | =4.01-beta | |
| Movable Type | =4.1-beta | |
| Movable Type | =4.2 | |
| Movable Type | =4.2-beta | |
| Movable Type | =4.3 | |
| Movable Type | =4.23 | |
| Movable Type | =4.25 | |
| Movable Type | =4.26 | |
| Movable Type | =4.31 | |
| Movable Type | =4.32 | |
| Movable Type | =4.33 | |
| Movable Type | =4.34 | |
| Movable Type | =4.35 | |
| Movable Type | =4.36 | |
| Movable Type | =4.261 | |
| Movable Type | =4.361 | |
| Movable Type | =5.1 | |
| Movable Type | =5.02 | |
| Movable Type | =5.03 | |
| Movable Type | =5.04 | |
| Movable Type | =5.05 | |
| Movable Type | =5.06 | |
| Movable Type | =5.11 | |
| Movable Type | =5.12 | |
| Movable Type | =5.031 | |
| Movable Type | =5.051 | |
| Movable Type | <=4.37 | |
| Movable Type | =4.0 | |
| Movable Type | =4.0-beta | |
| Movable Type | =4.1 | |
| Movable Type | =4.1-beta | |
| Movable Type | =4.01-beta | |
| Movable Type | =4.2 | |
| Movable Type | =4.2-beta | |
| Movable Type | =4.3 | |
| Movable Type | =4.23 | |
| Movable Type | =4.25 | |
| Movable Type | =4.26 | |
| Movable Type | =4.31 | |
| Movable Type | =4.32 | |
| Movable Type | =4.33 | |
| Movable Type | =4.34 | |
| Movable Type | =4.35 | |
| Movable Type | =4.36 | |
| Movable Type | =4.261 | |
| Movable Type | =4.361 | |
| Movable Type | =5.1 | |
| Movable Type | =5.02 | |
| Movable Type | =5.03 | |
| Movable Type | =5.04 | |
| Movable Type | =5.05 | |
| Movable Type | =5.06 | |
| Movable Type | =5.11 | |
| Movable Type | =5.12 | |
| Movable Type | =5.031 | |
| Movable Type | =5.051 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://jvn.jp/en/jp/JVN49836527/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016
- http://osvdb.org/79470
- http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2012/Feb/407
- http://www.debian.org/security/2012/dsa-2423
- http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html
- http://www.movabletype.org/documentation/appendices/release-notes/513.html
- http://www.securityfocus.com/bid/52138
- http://www.securitytracker.com/id?1026738
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73411
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73480
- https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt
Frequently Asked Questions
What is the severity of CVE-2012-1262?
CVE-2012-1262 has a severity rating of medium as it allows for cross-site scripting attacks in vulnerable versions of Movable Type.
How do I fix CVE-2012-1262?
To fix CVE-2012-1262, upgrade your Movable Type installation to version 4.38 or later for the Open Source editions or 5.07 or later for other editions.
What versions of Movable Type are affected by CVE-2012-1262?
CVE-2012-1262 affects Movable Type versions before 4.38, 5.0x before 5.07, and 5.1x before 5.13.
What is the nature of the attack vector for CVE-2012-1262?
The attack vector for CVE-2012-1262 is through the dbuser parameter, which can be used to inject arbitrary web scripts or HTML.
Is there a patch available for CVE-2012-1262?
No specific patch is available; users must upgrade to a newer version of Movable Type to mitigate the vulnerability.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/movabletype
- canonical/movable type open source
- version/movable type open source/4.37
- version/movable type open source/4.0
- version/movable type open source/4.0-beta
- version/movable type open source/4.1
- version/movable type open source/4.1-beta
- version/movable type open source/4.01-beta
- version/movable type open source/4.2
- version/movable type open source/4.2-beta
- version/movable type open source/4.3
- version/movable type open source/4.23
- version/movable type open source/4.25
- version/movable type open source/4.26
- version/movable type open source/4.31
- version/movable type open source/4.32
- version/movable type open source/4.33
- version/movable type open source/4.34
- version/movable type open source/4.35
- version/movable type open source/4.36
- version/movable type open source/4.261
- version/movable type open source/4.361
- version/movable type open source/5.1
- version/movable type open source/5.02
- version/movable type open source/5.03
- version/movable type open source/5.04
- version/movable type open source/5.05
- version/movable type open source/5.06
- version/movable type open source/5.11
- version/movable type open source/5.12
- version/movable type open source/5.031
- version/movable type open source/5.051
- canonical/movable type
- version/movable type/4.37
- version/movable type/4.0
- version/movable type/4.0-beta
- version/movable type/4.1
- version/movable type/4.01-beta
- version/movable type/4.1-beta
- version/movable type/4.2
- version/movable type/4.2-beta
- version/movable type/4.3
- version/movable type/4.23
- version/movable type/4.25
- version/movable type/4.26
- version/movable type/4.31
- version/movable type/4.32
- version/movable type/4.33
- version/movable type/4.34
- version/movable type/4.35
- version/movable type/4.36
- version/movable type/4.261
- version/movable type/4.361
- version/movable type/5.1
- version/movable type/5.02
- version/movable type/5.03
- version/movable type/5.04
- version/movable type/5.05
- version/movable type/5.06
- version/movable type/5.11
- version/movable type/5.12
- version/movable type/5.031
- version/movable type/5.051