Description
Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Six Apart | Movable Type (8.4.x series) | 8.4.1 and earlier | — |
| Six Apart | Movable Type (8.0.x series) | 8.0.5 and earlier | — |
| Six Apart | Movable Type Advanced (8.4.x series) | 8.4.1 and earlier | — |
| Six Apart | Movable Type Advanced (8.0.x series) | 8.0.5 and earlier | — |
| Six Apart | Movable Type Premium (2.x series) | 2.06 and earlier | — |
| Six Apart | Movable Type Premium (Advanced Edition) (2.x series) | 2.06 and earlier | — |
| Six Apart | Movable Type Cloud Edition (8.x series) | 8.4.1 and earlier | — |
| Six Apart | Movable Type Premium Cloud Edition (2.x series) | 2.06 and earlier | — |