CVE-2025-53522

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-53522", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-08-14T05:29:32.466Z", "datePublished": "2025-08-20T04:22:51.144Z", "dateUpdated": "2025-08-20T16:00:35.915Z"}, "containers": {"cna": {"affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type (Software Edition)", "versions": [{"version": "8.0.0 to 8.0.6", "status": "affected"}, {"version": "8.4.0 to 8.4.2 (8 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Software Edition)", "versions": [{"version": "7 r.5508 and earlier (7 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (Software Edition)", "versions": [{"version": "8.0.0 to 8.0.6", "status": "affected"}, {"version": "8.4.0 to 8.4.2 (8 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (Software Edition)", "versions": [{"version": "7 r.5508 and earlier (7 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Software Edition)", "versions": [{"version": "2.09 and earlier (2 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Software Edition)", "versions": [{"version": "1.66 and earlier (1 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (Software Edition)", "versions": [{"version": "2.09 and earlier (2 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (Software Edition)", "versions": [{"version": "1.66 and earlier (1 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Cloud Edition)", "versions": [{"version": "8.6.0 (8 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Cloud Edition)", "versions": [{"version": "7 r.5508 (7 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Cloud Edition)", "versions": [{"version": "2.09 (2 series)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Cloud Edition)", "versions": [{"version": "1.66 (1 series)", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."}], "problemTypes": [{"descriptions": [{"description": "Use of less trusted source", "lang": "en-US", "cweId": "CWE-348", "type": "CWE"}]}], "references": [{"url": "https://movabletype.org/news/2025/08/mt-843-released.html"}, {"url": "https://jvn.jp/en/jp/JVN76729865/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-08-20T04:22:51.144Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-20T16:00:10.875489Z", "id": "CVE-2025-53522", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-20T16:00:35.915Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-53522", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-20T16:00:10.875489Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-20T16:00:31.166Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type (Software Edition)", "versions": [{"status": "affected", "version": "8.0.0 to 8.0.6"}, {"status": "affected", "version": "8.4.0 to 8.4.2 (8 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Software Edition)", "versions": [{"status": "affected", "version": "7 r.5508 and earlier (7 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (Software Edition)", "versions": [{"status": "affected", "version": "8.0.0 to 8.0.6"}, {"status": "affected", "version": "8.4.0 to 8.4.2 (8 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced (Software Edition)", "versions": [{"status": "affected", "version": "7 r.5508 and earlier (7 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Software Edition)", "versions": [{"status": "affected", "version": "2.09 and earlier (2 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Software Edition)", "versions": [{"status": "affected", "version": "1.66 and earlier (1 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (Software Edition)", "versions": [{"status": "affected", "version": "2.09 and earlier (2 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition) (Software Edition)", "versions": [{"status": "affected", "version": "1.66 and earlier (1 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Cloud Edition)", "versions": [{"status": "affected", "version": "8.6.0 (8 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type (Cloud Edition)", "versions": [{"status": "affected", "version": "7 r.5508 (7 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Cloud Edition)", "versions": [{"status": "affected", "version": "2.09 (2 series)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Cloud Edition)", "versions": [{"status": "affected", "version": "1.66 (1 series)"}]}], "references": [{"url": "https://movabletype.org/news/2025/08/mt-843-released.html"}, {"url": "https://jvn.jp/en/jp/JVN76729865/"}], "descriptions": [{"lang": "en", "value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-348", "description": "Use of less trusted source"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-08-20T04:22:51.144Z"}}}, "cveMetadata": {"cveId": "CVE-2025-53522", "state": "PUBLISHED", "dateUpdated": "2025-08-20T16:00:35.915Z", "dateReserved": "2025-08-14T05:29:32.466Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2025-08-20T04:22:51.144Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Movable Type (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "8.0.0 to 8.0.6"}, {"status": "affected", "version": "8.4.0 to 8.4.2 (8 series)"}]}, {"product": "Movable Type (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "7 r.5508 and earlier (7 series)"}]}, {"product": "Movable Type Advanced (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "8.0.0 to 8.0.6"}, {"status": "affected", "version": "8.4.0 to 8.4.2 (8 series)"}]}, {"product": "Movable Type Advanced (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "7 r.5508 and earlier (7 series)"}]}, {"product": "Movable Type Premium (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "2.09 and earlier (2 series)"}]}, {"product": "Movable Type Premium (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "1.66 and earlier (1 series)"}]}, {"product": "Movable Type Premium (Advanced Edition) (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "2.09 and earlier (2 series)"}]}, {"product": "Movable Type Premium (Advanced Edition) (Software Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "1.66 and earlier (1 series)"}]}, {"product": "Movable Type (Cloud Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "8.6.0 (8 series)"}]}, {"product": "Movable Type (Cloud Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "7 r.5508 (7 series)"}]}, {"product": "Movable Type Premium (Cloud Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "2.09 (2 series)"}]}, {"product": "Movable Type Premium (Cloud Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "1.66 (1 series)"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker."}, {"lang": "es", "value": "Movable Type presenta un problema con el uso de una fuente menos confiable. Si se explota, un atacante remoto no autenticado podr\u00eda enviar un correo electr\u00f3nico manipulado para restablecer una contrase\u00f1a."}], "id": "CVE-2025-53522", "lastModified": "2026-06-17T09:38:22.613", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53522", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-20T16:00:10.875489Z", "version": "2.0.3"}}]}, "published": "2025-08-20T05:15:27.787", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN76729865/"}, {"source": "vultures@jpcert.or.jp", "url": "https://movabletype.org/news/2025/08/mt-843-released.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-348"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"created": "2025-08-21T12:31:30.057368+00:00", "updated": "2025-08-21T12:31:30.057442+00:00", "vendors": ["six_apart_ltd", "six_apart_ltd$PRODUCT$movable_type"]}