漏洞描述
MovableType 5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8. 2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
nemesis.shhttps://nemesis.sh/posts/movable-type-0day/↗twitter.comhttps://twitter.com/cyber_advising/status/1454051725904580608↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-20837↗packetstormsecurity.comhttp://packetstormsecurity.com/files/164818/Movable-Type-7-r.5002-XMLRPC-API-Remote-Command-Injection.html↗