CVE-2008-5846

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts to bypass intended access restrictions and publish posts via a "system-wide entry listing screen."

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2009
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2008

CVE-2008-58472.6Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensCVE-2008-584810.0The Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for remote attackers to obtain access through an CVE-2008-58495.0Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IPCVE-2008-58517.5SQL injection vulnerability in index.php in My PHP Baseball Stats (MyPBS) allows remote attackers to execute arbitrary SQL commands via the CVE-2008-58525.0Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downlCVE-2008-58535.0Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with insufficient access cCVE-2008-58544.3Multiple cross-site scripting (XSS) vulnerabilities in login.php in myPHPscripts Login Session 2.0 allow remote attackers to inject arbitrarCVE-2008-58555.0myPHPscripts Login Session 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackeCVE-2008-58565.0Directory traversal vulnerability in scripts/export.php in ClaSS before 0.8.61 allows remote attackers to read arbitrary files via directoryCVE-2008-58576.5The DropDocuments plugin in KnowledgeTree before 3.5.4a allows remote authenticated users to gain administrative privileges via a certain seCVE-2008-58584.3Multiple cross-site scripting (XSS) vulnerabilities in KnowledgeTree before 3.5.4a allow remote attackers to inject arbitrary web script or CVE-2008-58595.1SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disa
CVE-2008-5846: Medium severity, CVSS 4.0 | Vulnix