CVE-2014-9057
Estado: ModificadaAlta (7.5)—
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.99%
- Percentil entre todas las CVEs puntuadas: 80
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-89
Referencias
- http://secunia.com/advisories/61227
- https://movabletype.org/documentation/appendices/release-notes/6.0.6.html
- https://movabletype.org/news/2014/12/6.0.6.html
- https://www.debian.org/security/2015/dsa-3183
- http://secunia.com/advisories/61227
- https://movabletype.org/documentation/appendices/release-notes/6.0.6.html
- https://movabletype.org/news/2014/12/6.0.6.html
- https://www.debian.org/security/2015/dsa-3183
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-9057",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": true,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-12-16T18:59:12.840",
"references": [
{
"url": "http://secunia.com/advisories/61227",
"source": "cve@mitre.org"
},
{
"url": "https://movabletype.org/documentation/appendices/release-notes/6.0.6.html",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://movabletype.org/news/2014/12/6.0.6.html",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.debian.org/security/2015/dsa-3183",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/61227",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://movabletype.org/documentation/appendices/release-notes/6.0.6.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://movabletype.org/news/2014/12/6.0.6.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2015/dsa-3183",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyección SQL en la interfaz XML-RPC en Movable Type anterior a 5.18, 5.2.x anterior a 5.2.11, y 6.x anterior a 6.0.6 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados."
}
],
"lastModified": "2026-06-17T00:17:43.950",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sixapart:movable_type:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B49FB7A9-A9F2-42C3-9CAE-8858871083DC",
"versionEndIncluding": "5.17"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EBF8F8C-A971-4995-865D-64029D03B798"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D68B4C3-17CA-462B-9526-30FD66567CE0"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB1B3BEB-41F6-40E7-A7F6-3470442914C0"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "57ABAB73-F8B7-4B9F-B9A3-D40F70EB0657"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9136D5F8-1E70-44CA-B078-C58E68FE877D"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "941B8F26-D0F0-45A9-AE9F-F94E0601B653"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D25545AA-2386-4A1D-97DB-33CCA8F7C221"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA671B41-589B-454A-93A1-7E236149DB0A"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABC9C506-ACBD-4728-A9E5-FC20C5B0EC18"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:5.2.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CFC684C-329C-4E04-A2B6-2485E0FAEE2D"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "902C2FCF-BA2D-41C5-93FF-3BCDE3A47122"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49EEDEF1-6FC7-4351-BB0A-869399FA9897"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:6.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "317DFEBE-A802-4648-BD9C-FCFE60102F83"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:6.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49929D16-19EE-49C0-B234-5B5CD5E9E9EB"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:6.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0781073B-137B-448F-9C1B-D5CB704BD1D7"
},
{
"criteria": "cpe:2.3:a:sixapart:movable_type:6.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DCE0731-5212-4CBF-8D84-984F94925DFD"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}