Movable Type contains an issue with the use of a less trusted source. If exploited, a remote unauthenticated attacker may send a tampered email to reset a password. This vulnerability poses a risk to user accounts and can lead to unauthorized access.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2025-53522 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious email that appears to be a legitimate password reset request. By sending this email to a user, the attacker can trick them into resetting their password, potentially gaining unauthorized access to their account.
Affected Products
- Movable Type: A content management system that may allow unauthorized password resets through manipulated emails.
Mitigation
To mitigate this vulnerability, it is recommended to implement stricter validation of email sources and ensure that password reset requests are authenticated. Regular updates and patches should also be applied to the Movable Type system to address any security issues.