CVE-2022-43660: Code Injection
First published: Wed Dec 07 2022(Updated: )
Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.
Credit: vultures@jpcert.or.jp vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sixapart Movable Type | <=1.53 | |
| Sixapart Movable Type | <=1.53 | |
| Sixapart Movable Type | >=7.0<7.9.6 | |
| Sixapart Movable Type | >=7.0<7.9.6 | |
| <=1.53 | ||
| <=1.53 | ||
| >=7.0<7.9.6 | ||
| >=7.0<7.9.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-43660?
CVE-2022-43660 is a vulnerability in the Movable Type series that allows a remote authenticated attacker to execute arbitrary Perl scripts and OS commands.
What is the severity of CVE-2022-43660?
CVE-2022-43660 has a severity rating of 7.2 (high).
Which products/versions are affected by CVE-2022-43660?
The affected products/versions are Sixapart Movable Type Premium up to version 1.53, Sixapart Movable Type Premium Advanced up to version 1.53, Sixapart Movable Type between versions 7.0 and 7.9.6, and Sixapart Movable Type Advanced between versions 7.0 and 7.9.6.
How can a remote authenticated attacker exploit CVE-2022-43660?
A remote authenticated attacker with the privilege of 'Manage of Content Types' can exploit CVE-2022-43660 by executing arbitrary Perl scripts and OS commands.
Where can I find more information about CVE-2022-43660?
You can find more information about CVE-2022-43660 at the following references: [link1](https://jvn.jp/en/jp/JVN37014768/index.html), [link2](https://movabletype.org/news/2022/11/mt-796-688-released.html).
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/tags
- agent/softwarecombine
- agent/event
- vendor/sixapart
- canonical/sixapart movable type
- version/sixapart movable type/1.53
- version/sixapart movable type/7.0