CVE:CVE-2009-2492
CNNVD:CNNVD-200907-282
在4.261版本以前的Six Apart Movable Type的mt-wizard.cgi存在跨站脚本攻击漏洞会允许远程攻击者通过未知向量来注入任意WEB脚本或HTML。该漏洞与CVE-2009-2480不同。
solution:Upgrade six_apart movable_type to a higher version than 4.25,1.54,2.6,2.63,3.3,3.16,3.17,3.32,3.33,3.36,4,4.20,and avoid the version (,4.25],1.54,2.6,2.63,3.3,3.16,3.17,3.32,3.33,3.36,4,4.20; Upgrade six_apart_ltd movable_type to a higher version than *,3.33,and avoid the version 3.33; Upgrade sixapart movable_type to a higher version than 1.00,1.1,1.2,1.3,1.4,1.5,1.31,3.0d,3.1,3.01d,3.2,3.3,3.11,3.12,3.14,3.15,3.16,3.17,3.32,3.33,3.34,3.35,4.0,4.01,4.1,4.01:b,4.2,4.12,4.21,4.23,and avoid the version 1.00,1.1,1.2,1.3,1.4,1.5,1.31,3.0d,3.1,3.01d,3.2,3.3,3.11,3.12,3.14,3.15,3.16,3.17,3.32,3.33,3.34,3.35,4.0,4.01,4.1,4.01:b,4.2,4.12,4.21,4.23