« Volver al listado

CVE-2021-20814

Estado: ModificadaMedia (6.1)—

Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sixapart — Movable Type

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-20814",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Six Apart Ltd.",
          "product": "Movable Type",
          "versions": [
            {
              "status": "affected",
              "version": "Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-26T02:15:11.743",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN97545738/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://movabletype.org/news/2021/08/mt-780-681-released.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN97545738/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://movabletype.org/news/2021/08/mt-780-681-released.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4903 and earlier (Movable Type Advanced 7 Series), and Movable Type Premium 1.44 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site scripting en la pantalla Setting del plugin ContentType Information Widget de Movable Type (Movable Type versiones 7 r.4903 y anteriores (Movable Type 7 Series), Movable Type Advanced 7 versiones r.4903 y anteriores (Movable Type Advanced 7 Series), y Movable Type Premium versiones 1.44 y anteriores), permite a atacantes remotos inyectar script arbitrario o HTML por medio de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T03:34:29.773",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9ED3A1ED-558E-4783-8BCA-47BB68E92D9D",
              "versionEndIncluding": "1.44"
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D37106C9-92CD-44A8-A80B-57754207AE80",
              "versionEndExcluding": "7.8.0",
              "versionStartIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CA5A16F-B42D-4DC7-B9A0-5CA49B05DA7B",
              "versionEndExcluding": "7.8.0",
              "versionStartIncluding": "7.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}