Vulnerabilites related to Six Apart Ltd. - Movable Type Premium (Software Edition)
CVE-2025-53522 (GCVE-0-2025-53522)
Vulnerability from cvelistv5
Published
2025-08-20 04:22
Modified
2025-08-20 16:00
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-348 - Use of less trusted source
Summary
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T16:00:10.875489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T16:00:35.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of less trusted source",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:22:51.144Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-53522",
"datePublished": "2025-08-20T04:22:51.144Z",
"dateReserved": "2025-08-14T05:29:32.466Z",
"dateUpdated": "2025-08-20T16:00:35.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-55706 (GCVE-0-2025-55706)
Vulnerability from cvelistv5
Published
2025-08-20 04:23
Modified
2025-08-20 15:57
Severity ?
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-601 - URL redirection to untrusted site ('Open Redirect')
Summary
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Six Apart Ltd. | Movable Type (Software Edition) |
Version: 8.0.0 to 8.0.6 Version: 8.4.0 to 8.4.2 (8 series) |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T15:57:20.123486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T15:57:41.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "URL redirection to untrusted site (\u0027Open Redirect\u0027) issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL redirection to untrusted site (\u0027Open Redirect\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:23:01.512Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-55706",
"datePublished": "2025-08-20T04:23:01.512Z",
"dateReserved": "2025-08-14T05:29:33.614Z",
"dateUpdated": "2025-08-20T15:57:41.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}