CVE-2015-1592 : Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6

Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.

Published 2015-02-19 15:59:17

Updated 2019-10-09 00:20:52

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2015-1592

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Sixapart » Movable Type » PRO Edition
Versions from including (>=) 5.2.0 and before (<) 5.2.12
cpe:2.3:a:sixapart:movable_type:*:*:*:*:pro:*:*:*
Matching versions
Sixapart » Movable Type » Advanced Edition
Versions from including (>=) 6.0 and before (<) 6.0.7
cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*
Matching versions
Sixapart » Movable Type » Open Source Edition
Versions from including (>=) 5.2.0 and before (<) 5.2.12
cpe:2.3:a:sixapart:movable_type:*:*:*:*:open_source:*:*:*
Matching versions
Sixapart » Movable Type » PRO Edition
Versions from including (>=) 6.0 and before (<) 6.0.7
cpe:2.3:a:sixapart:movable_type:*:*:*:*:pro:*:*:*
Matching versions
Sixapart » Movable Type » Advanced Edition
Versions from including (>=) 5.2.0 and before (<) 5.2.12
cpe:2.3:a:sixapart:movable_type:*:*:*:*:advanced:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-1592

EPSS FAQ

85.60%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2015-1592

SixApart MovableType Storable Perl Code Execution

Disclosure Date: 2015-02-11

First seen: 2020-04-26

exploit/unix/webapp/sixapart_movabletype_storable_exec

This module exploits a serialization flaw in MovableType before 5.2.12 to execute arbitrary code. The default nondestructive mode depends on the target server having the Object::MultiType and DateTime Perl modules installed in Perl's @INC paths. The destructi

More information

CVSS scores for CVE-2015-1592

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2015-1592

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-1592

https://www.debian.org/security/2015/dsa-3183

Debian -- Security Information -- DSA-3183-1 movabletype-opensource
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2015/02/12/2

oss-security - CVE request: MovableType before 5.2.12
Mailing List;Third Party Advisory
http://www.securitytracker.com/id/1031777

Movable Type Include File Bug in Perl Storable Module Lets Remote Users Execute Local Scripts - SecurityTracker
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/72606

Movable Type CVE-2015-1592 Unspecified Local File Include Vulnerability
Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2015/02/12/17

oss-security - Re: CVE request: MovableType before 5.2.12 - Movable Type
Mailing List;Third Party Advisory
https://movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html

MovableType.org – News: Movable Type 6.0.7 and 5.2.12 released to close security vulnerability
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100912

Movable Type Storable::thaw() file include CVE-2015-1592 Vulnerability Report
Third Party Advisory;VDB Entry

Jump to