What’s Vulnerable › Vulnerabilities

CVE-2012-1262

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2012-03-03 · updated 2026-06-16
• Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.

Affected products

• Movabletype Movable Type Advanced: through 4.37; 4.0, 4.0-beta, 4.1, 4.01-beta, 4.1-beta, 4.2 (+23)
• Movabletype Movable Type Enterprise: through 4.37; 4.0, 4.0-beta, 4.1, 4.01-beta, 4.1-beta, 4.2 (+23)
• Movabletype Movable Type Open Source: through 4.37; 4.0, 4.0-beta, 4.1, 4.1-beta, 4.01-beta, 4.2 (+23)
• Movabletype Movable Type Pro: through 4.37; 4.0, 4.0-beta, 4.1, 4.1-beta, 4.01-beta, 4.2 (+23)

References

• http://jvn.jp/en/jp/JVN49836527/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016
• http://osvdb.org/79470
• http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2012/Feb/407
• http://www.debian.org/security/2012/dsa-2423
• http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html
• http://www.movabletype.org/documentation/appendices/release-notes/513.html
• http://www.securityfocus.com/bid/52138
• http://www.securitytracker.com/id?1026738
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73411
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73480

Get alerted when CVE-2012-1262 or the next vulnerability affects your stack