CVE-2025-55706

View on CVE.org
Published Aug 20, 2025 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-25324 URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
History
Type Values Removed Values Added
First Time appeared Six Apart Ltd
Six Apart Ltd movable Type
Vendors & Products Six Apart Ltd
Six Apart Ltd movable Type
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted into the password reset page, which may lead to redirection to an arbitrary URL.
Weaknesses CWE-601
References
Metrics cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
jpcert
Published
Updated
Aug 20, 2025, 3:57 PM
Reserved
Aug 14, 2025, 5:29 AM

View source JSON

Updated
Aug 20, 2025, 3:57 PM

JSON

Status
Deferred
Published
Aug 20, 2025, 5:15 AM
Modified
Jun 17, 2026, 9:42 AM

View source JSON

No data.

Updated
Aug 21, 2025, 12:31 PM

JSON