{"id":"CVE-2012-1262","state":"PUBLISHED","title":"Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed","description":"Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.","publishedAt":"2012-03-03T02:00:00.000Z","updatedAt":"2024-08-06T18:53:36.422Z","severity":null,"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html","http://seclists.org/fulldisclosure/2012/Feb/407","http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html","http://www.securityfocus.com/bid/52138","http://www.debian.org/security/2012/dsa-2423","http://www.securitytracker.com/id?1026738","https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt","http://www.movabletype.org/documentation/appendices/release-notes/513.html","http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016","https://exchange.xforce.ibmcloud.com/vulnerabilities/73480","https://exchange.xforce.ibmcloud.com/vulnerabilities/73411","http://jvn.jp/en/jp/JVN49836527/index.html","http://osvdb.org/79470"],"weaknesses":[],"ingestedAt":"2026-10-29T19:40:14.863Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2012/1xxx/CVE-2012-1262.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2012-1262","state":"PUBLISHED","datePublished":"2012-03-03T02:00:00.000Z","dateUpdated":"2024-08-06T18:53:36.422Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2012-02-22T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html","tags":["x_refsource_MISC"]},{"url":"http://seclists.org/fulldisclosure/2012/Feb/407","name":"20120224 TWSL2012-003: Cross-Site Scripting Vulnerability in Movable Type Publishing Platform","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/52138","name":"52138","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.debian.org/security/2012/dsa-2423","name":"DSA-2423","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securitytracker.com/id?1026738","name":"1026738","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt","tags":["x_refsource_MISC"]},{"url":"http://www.movabletype.org/documentation/appendices/release-notes/513.html","tags":["x_refsource_CONFIRM"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016","name":"JVNDB-2012-000016","tags":["third-party-advisory","x_refsource_JVNDB"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73480","name":"movable-type-publishing-mtwizard-xss(73480)","tags":["vdb-entry","x_refsource_XF"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73411","name":"movable-type-mtwizard-xss(73411)","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://jvn.jp/en/jp/JVN49836527/index.html","name":"JVN#49836527","tags":["third-party-advisory","x_refsource_JVN"]},{"url":"http://osvdb.org/79470","name":"79470","tags":["vdb-entry","x_refsource_OSVDB"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mitre","dateUpdated":"2018-01-17T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca"},"datePublic":"2012-02-23T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-1262","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html","refsource":"MISC","url":"http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html"},{"name":"20120224 TWSL2012-003: Cross-Site Scripting Vulnerability in Movable Type Publishing Platform","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2012/Feb/407"},{"name":"http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html","refsource":"CONFIRM","url":"http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html"},{"name":"52138","refsource":"BID","url":"http://www.securityfocus.com/bid/52138"},{"name":"DSA-2423","refsource":"DEBIAN","url":"http://www.debian.org/security/2012/dsa-2423"},{"name":"1026738","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1026738"},{"name":"https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt","refsource":"MISC","url":"https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt"},{"name":"http://www.movabletype.org/documentation/appendices/release-notes/513.html","refsource":"CONFIRM","url":"http://www.movabletype.org/documentation/appendices/release-notes/513.html"},{"name":"JVNDB-2012-000016","refsource":"JVNDB","url":"http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016"},{"name":"movable-type-publishing-mtwizard-xss(73480)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73480"},{"name":"movable-type-mtwizard-xss(73411)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73411"},{"name":"JVN#49836527","refsource":"JVN","url":"http://jvn.jp/en/jp/JVN49836527/index.html"},{"name":"79470","refsource":"OSVDB","url":"http://osvdb.org/79470"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2012/Feb/407","name":"20120224 TWSL2012-003: Cross-Site Scripting Vulnerability in Movable Type Publishing Platform","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/52138","name":"52138","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.debian.org/security/2012/dsa-2423","name":"DSA-2423","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securitytracker.com/id?1026738","name":"1026738","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.movabletype.org/documentation/appendices/release-notes/513.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016","name":"JVNDB-2012-000016","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73480","name":"movable-type-publishing-mtwizard-xss(73480)","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73411","name":"movable-type-mtwizard-xss(73411)","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://jvn.jp/en/jp/JVN49836527/index.html","name":"JVN#49836527","tags":["third-party-advisory","x_refsource_JVN","x_transferred"]},{"url":"http://osvdb.org/79470","name":"79470","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-06T18:53:36.422Z"}}]}}}