VIR Vulnerability Intelligence Relay

CVE-2012-0319

medium
Published 2012-03-03 · Modified 2026-04-29
CVSS v3
—
CVSS v2
6.5
VIR risk
6.5

Description

The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote authenticated users to execute arbitrary commands by leveraging the file-upload feature, related to an "OS Command Injection" issue.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: vultures@jpcert.or.jp — http://www.movabletype.org/documentation/appendices/release-notes/513.html

vendor Authored 2026-05-27

Vendor advisory: vultures@jpcert.or.jp — http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html

Application impact
VendorProductVersionsFixed
movabletypemovable_type_open_source{"endIncluding":"4.37"}
movabletypemovable_type_open_source4.0
movabletypemovable_type_open_source4.1
movabletypemovable_type_open_source4.01
movabletypemovable_type_open_source4.2
movabletypemovable_type_open_source4.3
movabletypemovable_type_open_source4.23
movabletypemovable_type_open_source4.25
movabletypemovable_type_open_source4.26
movabletypemovable_type_open_source4.31
movabletypemovable_type_open_source4.32
movabletypemovable_type_open_source4.33
movabletypemovable_type_open_source4.34
movabletypemovable_type_open_source4.35
movabletypemovable_type_open_source4.36
movabletypemovable_type_open_source4.261
movabletypemovable_type_open_source4.361
movabletypemovable_type_open_source5.1
movabletypemovable_type_open_source5.02
movabletypemovable_type_open_source5.03
movabletypemovable_type_open_source5.04
movabletypemovable_type_open_source5.05
movabletypemovable_type_open_source5.06
movabletypemovable_type_open_source5.11
movabletypemovable_type_open_source5.12
movabletypemovable_type_open_source5.031
movabletypemovable_type_open_source5.051
movabletypemovable_type_enterprise{"endIncluding":"4.37"}
movabletypemovable_type_enterprise4.0
movabletypemovable_type_enterprise4.1
movabletypemovable_type_enterprise4.01
movabletypemovable_type_enterprise4.2
movabletypemovable_type_enterprise4.3
movabletypemovable_type_enterprise4.23
movabletypemovable_type_enterprise4.25
movabletypemovable_type_enterprise4.26
movabletypemovable_type_enterprise4.31
movabletypemovable_type_enterprise4.32
movabletypemovable_type_enterprise4.33
movabletypemovable_type_enterprise4.34
movabletypemovable_type_enterprise4.35
movabletypemovable_type_enterprise4.36
movabletypemovable_type_enterprise4.261
movabletypemovable_type_enterprise4.361
movabletypemovable_type_enterprise5.1
movabletypemovable_type_enterprise5.02
movabletypemovable_type_enterprise5.03
movabletypemovable_type_enterprise5.04
movabletypemovable_type_enterprise5.05
movabletypemovable_type_enterprise5.06
movabletypemovable_type_enterprise5.11
movabletypemovable_type_enterprise5.12
movabletypemovable_type_enterprise5.031
movabletypemovable_type_enterprise5.051
movabletypemovable_type_advanced{"endIncluding":"4.37"}
movabletypemovable_type_advanced4.0
movabletypemovable_type_advanced4.1
movabletypemovable_type_advanced4.01
movabletypemovable_type_advanced4.2
movabletypemovable_type_advanced4.3
movabletypemovable_type_advanced4.23
movabletypemovable_type_advanced4.25
movabletypemovable_type_advanced4.26
movabletypemovable_type_advanced4.31
movabletypemovable_type_advanced4.32
movabletypemovable_type_advanced4.33
movabletypemovable_type_advanced4.34
movabletypemovable_type_advanced4.35
movabletypemovable_type_advanced4.36
movabletypemovable_type_advanced4.261
movabletypemovable_type_advanced4.361
movabletypemovable_type_advanced5.1
movabletypemovable_type_advanced5.02
movabletypemovable_type_advanced5.03
movabletypemovable_type_advanced5.04
movabletypemovable_type_advanced5.05
movabletypemovable_type_advanced5.06
movabletypemovable_type_advanced5.11
movabletypemovable_type_advanced5.12
movabletypemovable_type_advanced5.031
movabletypemovable_type_advanced5.051
movabletypemovable_type_pro{"endIncluding":"4.37"}
movabletypemovable_type_pro4.0
movabletypemovable_type_pro4.1
movabletypemovable_type_pro4.01
movabletypemovable_type_pro4.2
movabletypemovable_type_pro4.3
movabletypemovable_type_pro4.23
movabletypemovable_type_pro4.25
movabletypemovable_type_pro4.26
movabletypemovable_type_pro4.31
movabletypemovable_type_pro4.32
movabletypemovable_type_pro4.33
movabletypemovable_type_pro4.34
movabletypemovable_type_pro4.35
movabletypemovable_type_pro4.36
movabletypemovable_type_pro4.261
movabletypemovable_type_pro4.361
movabletypemovable_type_pro5.1
movabletypemovable_type_pro5.02
movabletypemovable_type_pro5.03
movabletypemovable_type_pro5.04
movabletypemovable_type_pro5.05
movabletypemovable_type_pro5.06
movabletypemovable_type_pro5.11
movabletypemovable_type_pro5.12
movabletypemovable_type_pro5.031
movabletypemovable_type_pro5.051

References

CWEs

CWE-94

Verify integrity in audit chain (admin only). AS-IS.