CVE:CVE-2009-2481
CNNVD:CNNVD-200907-267
Six Apart Movable Type before 4.261的mt-wizard.cgi在公共模板尚未初始化的情况下会允许远程攻击者绕过访问限制并(1) 发送电子邮件到任意地址或 (2) 获得敏感信息。
solution:Upgrade six_apart movable_type to a higher version than 1.54,2.6,2.63,3.3,3.16,3.17,3.32,3.33,3.36,4.20,4.25,and avoid the version 1.54,2.6,2.63,3.3,3.16,3.17,3.32,3.33,3.36,4.20,4.25; Upgrade sixapart movable_type to a higher version than 4.26,1.00,1.1,1.2,1.3,1.4,1.5,1.31,3.0d,3.1,3.01d,3.2,3.3,3.11,3.12,3.14,3.15,3.16,3.17,3.32,3.33,3.34,3.35,4.0,4.01,4.1,4.01:b,4.2,4.12,4.21,4.23,4.25,and avoid the version (,4.26],1.00,1.1,1.2,1.3,1.4,1.5,1.31,3.0d,3.1,3.01d,3.2,3.3,3.11,3.12,3.14,3.15,3.16,3.17,3.32,3.33,3.34,3.35,4.0,4.01,4.1,4.01:b,4.2,4.12,4.21,4.23,4.25