UpHeron
All vulnerabilities

Servers and applications

CVE-2022-38078

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and versions are as follows: Movable Type 7 r.5202 and earlier, Movable Type Advanced 7 r.5202 and earlier,…

Severity
Critical 9.8
Published
24 Aug 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.53, 6.8.7, 7.9.5
Sources
NVD

Affected software

SoftwareAffected versions
Movable TypeServers and applications · cpe:a:sixapart:movable_type
  • Every version before 1.53
  • From 6.0.0 before 6.8.7
  • From 7.0.0 before 7.9.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-38078
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-38078