CVE-2021-20837 Command injection in Movable Type
Remote attackers can execute arbitrary OS commands in Movable Type CMS, requiring immediate upgrades to secure the web application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20837?
CVE-2021-20837 is a critical command injection vulnerability in Six Apart Ltd. Movable Type, published on 26 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
Weakness: CWE-78
Which versions are affected by CVE-2021-20837?
It affects 1 product.
Products include Sixapart Movable Type.
How do I fix CVE-2021-20837?
No fix has been published for CVE-2021-20837 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-20837 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-20837 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Six Apart Ltd. Movable Type
Sources
Also known as GHSA-fq4q-8q83-6gj7.