CVE-2020-5574

Vulnerability

An HTML attribute value injection vulnerability exists in Movable Type series, including Movable Type 7 r.4606 (7.2.1) and earlier, Movable Type Advanced 7 r.4606 (7.2.1) and earlier, Movable Type for AWS 7 r.4606 (7.2.1) and earlier, Movable Type 6.5.3 and earlier, Movable Type Advanced 6.5.3 and earlier, Movable Type 6.3.11 and earlier, Movable Type Advanced 6.3.11 and earlier, Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier [1]. The vulnerability allows remote attackers to inject arbitrary HTML attribute values via unspecified vectors [1].

Exploitation

An attacker can exploit this vulnerability remotely with no authentication required, but user interaction is required (e.g., clicking a crafted link) [1]. The exact mechanism for injection is not detailed, but it involves manipulating input such that arbitrary attribute values are inserted into HTML elements [1].

Impact

Successful exploitation allows the attacker to inject arbitrary HTML attribute values, leading to low integrity impact [1]. This could be used to alter page behavior or appearance, but does not directly compromise confidentiality or availability [1].

Mitigation

Movable Type has released patched versions: Movable Type 7 r.4607 (7.3.0), Movable Type 6.6.0, and Movable Type 6.3.12 [2]. Users should upgrade to these versions or later. No workarounds are provided [2].