CVE-2015-1592
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7...
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
- Record
CVE-2015-1592- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
- Record
CVE-2015-1592- Updated
- 2026-11-02
EUVDEUVD-2015-1723 No score
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
- Record
EUVD-2015-1723- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j7c8-7vgp-wfmc No score
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7...
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
- Record
GHSA-j7c8-7vgp-wfmc- Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
movabletype-opensourceDebian:7 |
before 5.1.4+dfsg-4+deb7u2, plus listed versions 5.1.4+dfsg-45.1.4+dfsg-4+deb7u1 |
5.1.4+dfsg-4+deb7u2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SixApart MovableType < 5.2.12 - Storable Perl Code Execution (Metasploit) | 2015-02-11 |
| Metasploit | SixApart MovableType Storable Perl Code Execution | 2015-02-11 |
| PoC in GitHub | lightsey/cve-2015-1592 | 2015-04-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1592 is a high vulnerability (CVSS 7.5) in Sixapart Movable Type, published February 19, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.8%, the 99th percentile. Fixed in movabletype-opensource 5.1.4+dfsg-4+deb7u2.
References
debian.org/security/2015/dsa-3183
securitytracker.com/id/1031777
openwall.com/lists/oss-security/2015/02/12/2
exchange.xforce.ibmcloud.com/vulnerabilities/100912
movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html
securityfocus.com/bid/72606
nvd.nist.gov/vuln/detail/CVE-2015-1592
github.com/advisories/GHSA-j7c8-7vgp-wfmc