[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

249461

 
 

909

 
 

195508

 
 

282

 
Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2013-2184Date: (C)2015-03-28   (M)2023-12-22


Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 7.5
Exploit Score: 10.0
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
DSA-3183
http://seclists.org/oss-sec/2013/q2/560
http://seclists.org/oss-sec/2013/q2/568
https://movabletype.org/documentation/appendices/release-notes/movable-type-526-release-notes.html

CWE    1
CWE-17
OVAL    1
oval:org.secpod.oval:def:601985

© SecPod Technologies