CVE-2021-20665

Vulnerability

Movable Type 7 r.4705 and earlier, Movable Type Advanced 7 r.4705 and earlier, Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier contain a cross-site scripting vulnerability in the Add asset screen of the Contents field. An attacker can inject an arbitrary script via unspecified vectors [1].

Exploitation

An unauthenticated attacker can craft a malicious link or content that, when interacted with by a logged-in user (e.g., clicking a link or visiting a crafted page), triggers execution of the injected script in the user's browser. No special network position is required beyond typical web access [1].

Impact

Successful exploitation allows arbitrary script execution in the context of the logged-in user's session. This can lead to information disclosure (e.g., reading session cookies), modification of page content, or additional actions performed on behalf of the victim [1].

Mitigation

Update to the latest version: Movable Type 7 r.4706 (v7.6.0) or Movable Type Advanced 7 r.4706 for the 7 series; Movable Type 6.7.6 for the 6.7 series. The fixed versions were released on 2021-02-24 [2]. No workarounds have been published.