CVE-2020-5528

Vulnerability

Movable Type series contains a cross-site scripting vulnerability (CWE-79) in the block editor and the rich text editor. Affected versions include Movable Type 7 r.4603 and earlier, Movable Type 6.5.2 and earlier, Movable Type Advanced 7 r.4603 and earlier, Movable Type Advanced 6.5.2 and earlier, Movable Type Premium 1.26 and earlier, and Movable Type Premium Advanced 1.26 and earlier [1]. An attacker can inject arbitrary web script or HTML via a specially crafted URL [1].

Exploitation

An attacker does not require authentication but relies on user interaction: a logged-in user must visit a page containing the malicious URL while using the block editor or rich text editor. The attack vector is network-based, and the scope changes due to the injected script executing in the context of the editor session [1].

Impact

Successful exploitation allows arbitrary script execution in the logged-in user's web browser. This can lead to information disclosure (e.g., session tokens, page content) or further actions within the CMS context, with low impact on confidentiality and integrity [1].

Mitigation

Update to the latest version per the vendor: Movable Type 7 r.4605 (v7.2.0), Movable Type 6.5.3, or Movable Type 6.3.11, which contain the security fix [2]. For affected Premium editions, corresponding updated versions should also be applied. No workarounds are provided in the references.