Vulnerability Description
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Movabletype | Movable Type | <= 7.4705 |
| Movabletype | Movable Type Advanced | <= 7.4705 |
| Movabletype | Movable Type Premium | <= 1.39 |
| Movabletype | Movable Type Premium Advanced | <= 1.39 |
Related Weaknesses (CWE)
References
- https://jvn.jp/en/jp/JVN66542874/index.htmlThird Party Advisory
- https://movabletype.org/news/2021/02/mt-760-676-released.htmlRelease NotesVendor Advisory
- https://jvn.jp/en/jp/JVN66542874/index.htmlThird Party Advisory
- https://movabletype.org/news/2021/02/mt-760-676-released.htmlRelease NotesVendor Advisory
FAQ
What is CVE-2021-20665?
CVE-2021-20665 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advan...
How severe is CVE-2021-20665?
CVE-2021-20665 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-20665?
Check the references section above for vendor advisories and patch information. Affected products include: Movabletype Movable Type, Movabletype Movable Type Advanced, Movabletype Movable Type Premium, Movabletype Movable Type Premium Advanced.