CVE-2021-20837

EPSS 88.1%

Vexday Risk Score

60Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

CVSS —EPSS 88.1%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Ciclo de vida

25 out 2021PoC pública

26 out 2021Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.

Produtos afetados

Six Apart Ltd. · Movable Type

PoCs públicas encontradas — 6

githubgithub.com/orangmuda/CVE-2021-20837★ 21 githubgithub.com/ghost-nemesis/cve-2021-20837-poc★ 18 githubgithub.com/Cosemz/CVE-2021-20837★ 0 cve_referencepacketstormsecurity.com/files/164705/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.htmlnão verificado cve_referencepacketstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.htmlnão verificado exploitdbwww.exploit-db.com/exploits/50464não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://packetstormsecurity.com/files/164705/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html http://packetstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html https://jvn.jp/en/jp/JVN41119755/index.html https://movabletype.org/news/2021/10/mt-782-683-released.html