Is CVE-2016-5742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-5742 being exploited in the wild.

How severe is CVE-2016-5742?

Critical severity, with a CVSS score of 9.8, published 23 January 2017.

Which products and versions are affected?

Six Apart Movable Type Advanced 6.0.x, 6.1.x before 6.1.3, 6.2.x before 6.2.6; Six Apart Movable Type Pro 6.0.x, 6.1.x before 6.1.3, 6.2.x before 6.2.6.

Is there a fix for CVE-2016-5742?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-5742 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-5742?

Check whether you run Six Apart Movable Type Advanced or Six Apart Movable Type Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5742: Six Apart Movable Type SQL injection in XML-RPC interface

CVE-2016-5742 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Movable Type, a popular content management system, contains a critical security flaw in its XML-RPC interface. This interface is used for remote communication and automated posting. An attacker can exploit this flaw to run unauthorized database commands, which could lead to the theft of sensitive data, modification of website content, or full system takeover. Organizations using affected versions should update to the latest patched releases immediately to prevent unauthorized access.

Quick answers

Is CVE-2016-5742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-5742 being exploited in the wild.
How severe is CVE-2016-5742?: Critical severity, with a CVSS score of 9.8, published 23 January 2017.
Which products and versions are affected?: Six Apart Movable Type Advanced 6.0.x, 6.1.x before 6.1.3, 6.2.x before 6.2.6; Six Apart Movable Type Pro 6.0.x, 6.1.x before 6.1.3, 6.2.x before 6.2.6.
Is there a fix for CVE-2016-5742?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-5742 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-5742?: Check whether you run Six Apart Movable Type Advanced or Six Apart Movable Type Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the XML-RPC interface of Movable Type. The flaw is caused by improper neutralization of special elements used in SQL commands (CWE-89) within the XML-RPC handling logic. A remote, unauthenticated attacker can exploit this by sending specially crafted XML-RPC requests to the server. Successful exploitation allows the attacker to execute arbitrary SQL commands against the underlying database, potentially leading to full compromise of the application's data and administrative credentials. The issue affects Movable Type Pro/Advanced 6.x (prior to 6.1.3 and 6.2.6) and Open Source 5.2.13 and earlier. Patches are available in versions 6.1.3 and 6.2.6.

Affected products

Six Apart Movable Type Pro 6.0.x, 6.1.x before 6.1.3, 6.2.x before 6.2.6
Six Apart Movable Type Advanced 6.0.x, 6.1.x before 6.1.3, 6.2.x before 6.2.6
Six Apart Movable Type Open Source 5.2.13 and earlier

Timeline

2016-06-22: advisory: Vendor advisory and release notes published by Six Apart
2016-06-22: disclosed: Public disclosure on oss-security mailing list
2017-01-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.