$ cve CVE-2021-20837 JSON

CVE-2021-20837 EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 88.1% (pctl 100)

Patch early

A public exploit exists.

Description

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	88.14% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	yes
Published	2021-10-26
Last modified	2026-06-17

Affected (1)

Vendor	Product
sixapart	movable type

Public exploits

Source	Title	Date
exploit-db	Movable Type 7 r.5002 - XMLRPC API OS Command Injection (Metasploit)	2021-10-29

References

→ the Explorer · watch your stack · NVD