CVE-2020-5576

Vulnerability

Movable Type series before versions 7.3.0 (r.4607), 6.6.0, and 6.3.12 contain a cross-site request forgery (CSRF) vulnerability ([CWE-352]) in multiple editions: Movable Type 7, Movable Type Advanced 7, Movable Type for AWS 7, Movable Type 6.5, Movable Type Advanced 6.5, Movable Type 6.3, Movable Type Advanced 6.3, Movable Type Premium 1.29, and Movable Type Premium Advanced 1.29 (all versions up to the respective patched releases) [1][2]. The specific code path is not detailed, but the vulnerability allows forged requests to be processed without proper CSRF token validation.

Exploitation

The attacker requires network access to the victim's browser and must trick an authenticated administrator into clicking a malicious link or visiting a crafted page while logged into Movable Type. No authentication is needed for the attacker; the exploit relies on the victim's active session. The exact vectors are undisclosed, but typical CSRF attacks involve crafted forms or image tags [1].

Impact

Successful exploitation enables an attacker to perform unauthorized actions on behalf of the victim administrator, resulting in integrity impact (e.g., modifying content, settings, or creating accounts). Confidentiality and availability are not directly affected. The CVSS v3 base score is 4.3 (Medium) and CVSS v2 base score is 2.6 (Low) [1].

Mitigation

Six Apart released fixed versions: Movable Type 7 r.4607 (v7.3.0), Movable Type Advanced 7 r.4607 (v7.3.0), Movable Type for AWS 7 r.4607 (v7.3.0), Movable Type 6.6.0, Movable Type Advanced 6.6.0, Movable Type for AWS 6.6.0, Movable Type 6.3.12, and Movable Type Advanced 6.3.12 on May 14, 2020 [2]. Users should upgrade to these versions or later. For users of Movable Type 6.3.x, note that maintenance ended on May 16, 2019, and security support only until May 16, 2020, so upgrading to a supported series is recommended [2].