Movable Type mt-wizard.cgi set_static_uri_to Parameter XSS

medium Nessus Plugin ID 39538

Language:

Synopsis

A Perl application hosted on the remote web server has a cross-site scripting vulnerability.

Description

The version of Movable Type running on the remote host has a cross- site scripting vulnerability in 'mt-wizard.cgi'. Input to the 'set_static_uri_to' parameter is not sanitized. A remote attacker could exploit this by tricking a user into submitting a specially crafted POST request, which would execute arbitrary script code in the context of the web server.

There is also reportedly a security bypass vulnerability in this version of Movable Type, though Nessus has not checked for this issue.

Solution

Upgrade to Movable Type version 4.26 or later.

Plugin Details

Severity: Medium

ID: 39538

File Name: movabletype_mtwizardcgi_xss.nasl

Version: 1.23

Type: remote

Family: CGI abuses : XSS

Published: 6/26/2009

Updated: 6/5/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/a:sixapart:movable_type

Required KB Items: www/movabletype

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Exploited by Nessus: true

Reference Information

CVE: CVE-2009-2480

BID: 35471

CWE: 79

SECUNIA: 35534

Detections

Analytics