{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22888", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-02-03T00:23:33.090Z", "datePublished": "2025-02-19T05:52:02.918Z", "dateUpdated": "2025-02-19T14:54:27.745Z"}, "containers": {"cna": {"affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type (8.4.x series)", "versions": [{"version": "8.4.1 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (8.0.x series)", "versions": [{"version": "8.0.5 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (8.4.x series)", "versions": [{"version": "8.4.1 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (8.0.x series)", "versions": [{"version": "8.0.5 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (2.x series)", "versions": [{"version": "2.06 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (2.x series)", "versions": [{"version": "2.06 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Cloud Edition (8.x series)", "versions": [{"version": "8.4.1 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium Cloud Edition (2.x series)", "versions": [{"version": "2.06 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting (XSS)", "lang": "en-US", "cweId": "CWE-79", "type": "CWE"}]}], "references": [{"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"}, {"url": "https://jvn.jp/en/jp/JVN48742353/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-02-19T05:52:02.918Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-19T14:54:09.952776Z", "id": "CVE-2025-22888", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T14:54:27.745Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22888", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-19T14:54:09.952776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T14:54:07.371Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type (8.4.x series)", "versions": [{"status": "affected", "version": "8.4.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (8.0.x series)", "versions": [{"status": "affected", "version": "8.0.5 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (8.4.x series)", "versions": [{"status": "affected", "version": "8.4.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (8.0.x series)", "versions": [{"status": "affected", "version": "8.0.5 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (2.x series)", "versions": [{"status": "affected", "version": "2.06 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (2.x series)", "versions": [{"status": "affected", "version": "2.06 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Cloud Edition (8.x series)", "versions": [{"status": "affected", "version": "8.4.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium Cloud Edition (2.x series)", "versions": [{"status": "affected", "version": "2.06 and earlier"}]}], "references": [{"url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"}, {"url": "https://jvn.jp/en/jp/JVN48742353/"}], "descriptions": [{"lang": "en", "value": "Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-79", "description": "Cross-site scripting (XSS)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-02-19T05:52:02.918Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22888", "state": "PUBLISHED", "dateUpdated": "2025-02-19T14:54:27.745Z", "dateReserved": "2025-02-03T00:23:33.090Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2025-02-19T05:52:02.918Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser."}, {"lang": "es", "value": "El tipo m\u00f3vil contiene una vulnerabilidad Cross-Site Scripting Almacenado en la p\u00e1gina de edici\u00f3n de bloque personalizado del editor de bloques MT. Si se explota, un script arbitrario puede ejecutarse en el navegador web de un usuario iniciado."}], "id": "CVE-2025-22888", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}, "published": "2025-02-19T06:15:21.687", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN48742353/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.movabletype.org/news/2025/02/mt-842-released.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{}