Description
mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors.
References
- JVN#08369659 third-party-advisory
- 35534 third-party-advisory
- ADV-2009-1668 vdb-entry
- JVNDB-2009-000043 third-party-advisory
- 35471 vdb-entry
- movabletype-mtwizard-security-bypass(51330) vdb-entry