CVE-2013-2184 Deserialization in n/a

What is CVE-2013-2184?

CVE-2013-2184 is a high-severity unsafe deserialization vulnerability in n/a, published on 27 Mar 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

Weakness: CWE-17

Which versions are affected by CVE-2013-2184?

It affects 1 product.

Products include Sixapart Movable Type.

How do I fix CVE-2013-2184?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2013-2184 being exploited?

There is no known exploitation of CVE-2013-2184 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2009-0752 Other in n/a Critical 10.0
• CVE-2022-38078 Command injection in Movable Type XMLRPC API Critical 9.8
• CVE-2021-20837 Command injection in Movable Type Critical 9.8
• CVE-2016-5742 SQL injection in n/a Critical 9.8
• CVE-2026-25776 Code injection in Movable Type Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cr72-56w8-rrw3.