CVE-2023-45746

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Movable Type series, including Movable Type 7 r.5405 and earlier, Movable Type Advanced 7 r.5405 and earlier, Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type Cloud Edition (Version 7) r.5405 and earlier, and Movable Type Premium Cloud Edition 1.58 and earlier [1][2]. The vulnerability allows an authenticated attacker to inject arbitrary script into the application, which may be executed in the context of another logged-in user's browser.

Exploitation

An attacker must be authenticated to the Movable Type instance. The attacker can craft malicious input that, when viewed by another authenticated user, executes arbitrary JavaScript in the victim's browser. The exact attack vector is not detailed in the available references, but it is classified as a stored or reflected XSS depending on the injection point [1].

Impact

Successful exploitation allows the attacker to execute arbitrary script in the context of the victim's session. This can lead to information disclosure (e.g., session tokens, cookies), unauthorized actions performed on behalf of the victim, or defacement of the application interface [1].

Mitigation

Six Apart has released updates that fix this vulnerability: Movable Type 7 r.5501, Movable Type Advanced 7 r.5501, Movable Type Premium 1.59, Movable Type Premium Advanced 1.59, Movable Type Cloud Edition (Version 7) r.5501, and Movable Type Premium Cloud Edition 1.59 [1][2]. Users should upgrade to these versions immediately. No workarounds are documented in the available references.