CVE request: MovableType before 5.2.12

[John Lightsey <john () nixnuts net>]

Hi there,

MoveableType 5.2.12 was released today to fix a flaw where Perl's
Storable::thaw() was called on data sent by unauthenticated remote users
in some interfaces.

https://movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html

The payload example provided to SixApart was a local file inclusion
attack, but unauthenticated arbitrary remote code execution should be
straightforward by tailoring the payload for the mix of Perl installed
on the system running MTOS.

Please assign a CVE number for this issue.

John

Attachment: signature.asc
Description: This is a digitally signed message part