Description
Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Six Apart | Movable Type | 8.0.0 ≤8.0.13 | — |
| Six Apart | Movable Type Advanced | 8.8.0 ≤8.8.6 | — |
| Six Apart | Movable Type Advanced | 8.0.0 ≤8.0.13 | — |
| Six Apart | Movable Type | 8.8.0 ≤8.8.6 | — |
| Six Apart | Movable Type Premium Advanced Edition | 2.00 ≤2.18 | — |
| Six Apart | Movable Type Premium | 2.00 ≤2.18 | — |