CVEvulnerability
CVE-2015-4427
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-06-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.114) allow remote authenticated users to inject arbitrary web script or HTML via the (1) page, (2) action, (3) folder_id, or (4) LangType parameter.
Affected configurations
• ektron ektron content management system (<= 9.1)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/132105/Ektron-CMS-9.10-SP1-Cross-Site-Scripting.html Exploit
- http://v00d00sec.com/2015/05/31/cve-2015-3624-csrf-and-xss-vulnerabilities-in-ektron-cms-9-10-sp1/ Exploit
- http://www.securityfocus.com/archive/1/535647/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/74942 www.securityfocus.com
- http://packetstormsecurity.com/files/132105/Ektron-CMS-9.10-SP1-Cross-Site-Scripting.html Exploit
- http://v00d00sec.com/2015/05/31/cve-2015-3624-csrf-and-xss-vulnerabilities-in-ektron-cms-9-10-sp1/ Exploit
- http://www.securityfocus.com/archive/1/535647/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/74942 www.securityfocus.com