Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Movable Type Premium (Cloud Edition) by Six Apart Ltd.
CVE-2025-55706 (GCVE-0-2025-55706)
Vulnerability from nvd – Published: 2025-08-20 04:23 – Updated: 2025-08-20 15:57
VLAI
Summary
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL redirection to untrusted site ('Open Redirect')
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T15:57:20.123486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T15:57:41.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "URL redirection to untrusted site (\u0027Open Redirect\u0027) issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL redirection to untrusted site (\u0027Open Redirect\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:23:01.512Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-55706",
"datePublished": "2025-08-20T04:23:01.512Z",
"dateReserved": "2025-08-14T05:29:33.614Z",
"dateUpdated": "2025-08-20T15:57:41.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53522 (GCVE-0-2025-53522)
Vulnerability from nvd – Published: 2025-08-20 04:22 – Updated: 2025-08-20 16:00
VLAI
Summary
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-348 - Use of less trusted source
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T16:00:10.875489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T16:00:35.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of less trusted source",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:22:51.144Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-53522",
"datePublished": "2025-08-20T04:22:51.144Z",
"dateReserved": "2025-08-14T05:29:32.466Z",
"dateUpdated": "2025-08-20T16:00:35.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-55706 (GCVE-0-2025-55706)
Vulnerability from cvelistv5 – Published: 2025-08-20 04:23 – Updated: 2025-08-20 15:57
VLAI
Summary
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL redirection to untrusted site ('Open Redirect')
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T15:57:20.123486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T15:57:41.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "URL redirection to untrusted site (\u0027Open Redirect\u0027) issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL redirection to untrusted site (\u0027Open Redirect\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:23:01.512Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-55706",
"datePublished": "2025-08-20T04:23:01.512Z",
"dateReserved": "2025-08-14T05:29:33.614Z",
"dateUpdated": "2025-08-20T15:57:41.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53522 (GCVE-0-2025-53522)
Vulnerability from cvelistv5 – Published: 2025-08-20 04:22 – Updated: 2025-08-20 16:00
VLAI
Summary
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-348 - Use of less trusted source
Assigner
References
2 references
Impacted products
12 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-20T16:00:10.875489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T16:00:35.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.0.0 to 8.0.6"
},
{
"status": "affected",
"version": "8.4.0 to 8.4.2 (8 series)"
}
]
},
{
"product": "Movable Type Advanced (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 and earlier (7 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 and earlier (2 series)"
}
]
},
{
"product": "Movable Type Premium (Advanced Edition) (Software Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 and earlier (1 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "8.6.0 (8 series)"
}
]
},
{
"product": "Movable Type (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "7 r.5508 (7 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "2.09 (2 series)"
}
]
},
{
"product": "Movable Type Premium (Cloud Edition)",
"vendor": "Six Apart Ltd.",
"versions": [
{
"status": "affected",
"version": "1.66 (1 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of less trusted source",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-20T04:22:51.144Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://movabletype.org/news/2025/08/mt-843-released.html"
},
{
"url": "https://jvn.jp/en/jp/JVN76729865/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2025-53522",
"datePublished": "2025-08-20T04:22:51.144Z",
"dateReserved": "2025-08-14T05:29:32.466Z",
"dateUpdated": "2025-08-20T16:00:35.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}