CVE-2021-20837

Katalog CVE

CVSS 9.8 · Critical EPSS 88,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada sixapart movable type. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.

Rincian

Terbit di NVD

26 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

88,1% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://movabletype.org/news/2021/10/mt-782-683-released.html release notes · advisory vendor
• http://packetstormsecurity.com/files/164705/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html advisory pihak ketiga · vdb entry
• https://jvn.jp/en/jp/JVN41119755/index.html advisory pihak ketiga