CVEvulnerability
CVE-2012-5357
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-10-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-19
Description
Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.
Affected configurations
• ektron ektron content management system (<= 8.02)
Related
Weakness · not in database (1)
References
- http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm Issue Tracking, Vendor Advisory
- https://technet.microsoft.com/library/security/msvr12-016 Issue Tracking, Release Notes, Third Party Advisory
- https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/ Exploit, Issue Tracking, Third Party Advisory
- https://www.rapid7.com/db/modules/exploit/windows/http/ektron_xslt_exec Exploit, Issue Tracking, Third Party Advisory
- http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm Issue Tracking, Vendor Advisory
- https://technet.microsoft.com/library/security/msvr12-016 Issue Tracking, Release Notes, Third Party Advisory
- https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/ Exploit, Issue Tracking, Third Party Advisory
- https://www.rapid7.com/db/modules/exploit/windows/http/ektron_xslt_exec Exploit, Issue Tracking, Third Party Advisory