How severe is CVE-2013-0209?

CVE-2013-0209 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2013-0209 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 45% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-0209?

CVE-2013-0209 primarily affects Sixapart Movable Type. In total, 33 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2013-0209?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2013-0209 published?

CVE-2013-0209 was published on 2013-01-23 and last updated on 2026-06-16.

CVE-2013-0209

CVE-2013-0209 is a high-severity vulnerability in Sixapart Movable Type with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 45% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-287.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 45% (99th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-287
Affected product: Sixapart Movable Type
Published: 2013-01-23
Last modified: 2026-06-16

Description

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.

Frequently asked questions

What is CVE-2013-0209?: lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
How severe is CVE-2013-0209?: CVE-2013-0209 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2013-0209 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 45% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2013-0209?: CVE-2013-0209 primarily affects Sixapart Movable Type. In total, 33 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2013-0209?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2013-0209 published?: CVE-2013-0209 was published on 2013-01-23 and last updated on 2026-06-16.

References

Affected products (33)

cpe:2.3:a:sixapart:movable_type:4.21:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.22:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.23:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.24:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.25:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.26:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.27:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.28:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.28:*:enterprise:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.28:*:open_source:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.29:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.29:*:enterprise:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.29:*:open_source:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.31:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.32:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.33:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.34:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.35:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.36:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.37:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.38:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.261:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.291:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.291:*:enterprise:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.291:*:open_source:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.292:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.292:*:enterprise:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.292:*:open_source:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.361:*:*:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.36:*:open_source:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.37:*:open_source:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.38:*:open_source:*:*:*:*:*
cpe:2.3:a:sixapart:movable_type:4.361:*:open_source:*:*:*:*:*

More vulnerabilities in Sixapart Movable Type

CVE-2009-0752 — Critical (CVSS 10.0): Unspecified vulnerability in Movable Type Pro and Community Solution 4.x before 4.24 has unknown impact and attack…
CVE-2026-33088 — Critical (CVSS 9.8): Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute…
CVE-2026-25776 — Critical (CVSS 9.8): Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute…
CVE-2022-38078 — Critical (CVSS 9.8): Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially…
CVE-2021-20837 — Critical (CVSS 9.8): Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series),…
CVE-2016-5742 — Critical (CVSS 9.8): SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before…

All CVEs affecting Sixapart Movable Type →

Other CWE-287 (Improper Authentication) vulnerabilities

CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…

Browse all CWE-287 (Improper Authentication) vulnerabilities →