Headline
CVE-2022-38972: Movable Type plugin A-Form vulnerable to cross-site scripting
Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script.
Published:2022/09/09 Last Updated:2022/09/09
Overview
Movable Type plugin A-Form contains a cross-site scripting vulnerability.
Products Affected
- A-Form versions prior to 4.1.1 (for Movable Type 7 Series)
- A-Form versions prior to 3.9.1 (for Movable Type 6 Series)
The developer states that A-Member, A-Reserve, and A-Member Subscription Pack are affected too, because they contain an affected version of A-Form.
Description
Movable Type plugin A-Form provided by ARK-Web co., ltd. contains a cross-site scripting vulnerability (CWE-79).
Impact
An arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Solution
Update the Software
Update A-Form to the latest version according to the information provided by the developer.
Vendor Status
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector(AV)
Physical §
Local (L)
Adjacent (A)
Network (N)
Attack Complexity(AC)
High (H)
Low (L)
Privileges Required(PR)
High (H)
Low (L)
None (N)
User Interaction(UI)
Required ®
None (N)
Scope(S)
Unchanged (U)
Changed ©
Confidentiality Impact©
None (N)
Low (L)
High (H)
Integrity Impact(I)
None (N)
Low (L)
High (H)
Availability Impact(A)
None (N)
Low (L)
High (H)
CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector(AV)
Local (L)
Adjacent Network (A)
Network (N)
Access Complexity(AC)
High (H)
Medium (M)
Low (L)
Authentication(Au)
Multiple (M)
Single (S)
None (N)
Confidentiality Impact©
None (N)
Partial §
Complete ©
Integrity Impact(I)
None (N)
Partial §
Complete ©
Availability Impact(A)
None (N)
Partial §
Complete ©
Credit
hibiki moriyama of STNet, Incorporated reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information