CVE:CVE-2012-1497
CNNVD:CNNVD-201203-023
Six Apart Movable Type（MT）是美国Six Apart公司的一套博客（blog）系统。
Movable Type 4.38之前版本，5.07之前的5.0x版本，及5.13之前的5.1x版本的默认配置支持'mt:Include file='属性。远程认证用户可利用template-designer角色执行目录遍历攻击进而读取任意文件。
solution:Upgrade movabletype movable_type_open_source to a higher version than 4.37,4.0,4.0:beta,4.1,4.1:beta,4.01:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051,and avoid the version (,4.37],4.0,4.0:beta,4.1,4.1:beta,4.01:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051; Upgrade movabletype movable_type_enterprise to a higher version than 4.37,4.0,4.0:beta,4.1,4.01:beta,4.1:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051,and avoid the version (,4.37],4.0,4.0:beta,4.1,4.01:beta,4.1:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051; Upgrade movabletype movable_type_advanced to a higher version than 4.37,4.0,4.0:beta,4.1,4.01:beta,4.1:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051,and avoid the version (,4.37],4.0,4.0:beta,4.1,4.01:beta,4.1:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051; Upgrade movabletype movable_type_pro to a higher version than 4.37,4.0,4.0:beta,4.1,4.1:beta,4.01:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051,and avoid the version (,4.37],4.0,4.0:beta,4.1,4.1:beta,4.01:beta,4.2,4.2:beta,4.3,4.23,4.25,4.26,4.31,4.32,4.33,4.34,4.35,4.36,4.261,4.361,5.1,5.02,5.03,5.04,5.05,5.06,5.11,5.12,5.031,5.051