Description
Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type 4.24, and 4.25 when global templates are not initialized, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
- JVN#97248625 third-party-advisory
- 35534 third-party-advisory
- http://www.movabletype.org/documentation/appendices/release-notes/426.html
- ADV-2009-1668 vdb-entry
- JVNDB-2009-000020 third-party-advisory
- movabletype-mtwizard-xss(51329) vdb-entry
- 35471 vdb-entry