JVNDB-2010-000001

Movable Type access restriction bypass vulnerability

Movable Type contains an access restriction bypass vulnerability.

Movable Type, a web log system from Six Apart KK, contains a vulnerability that allows a remote attacker to bypass access restrictions.

This vulnerability is different from JVN#08369659.

Base Metrics: 5.5 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: Single Instance
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: None

Six Apart

• Movable Type 4.261 (Open Source) and earlier
• Movable Type 4.261 (includes Professional and Community Packs) and earlier
• Movable Type 5.0 (Open Source)
• Movable Type 5.0 (includes Professional and Community Packs)
• Movable Type Commercial 4.261 (includes Professional Pack) and earlier
• Movable Type Enterprise 4.261 and earlier

A remote attacker may view or modify information stored by Movable Type.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Six Apart

• MOVABLETYPE : Movable Type 5
• MOVABLETYPE : Security Update Movable Type 5.01 and 4.27 (Japanese)

1. JVN : JVN#09872874
2. Common Weakness Enumeration (CWE) : Permissions, Privileges, and Access Controls (CWE-264) [IPA Evaluation]

[2010/01/06]
  Web page published