CVE-2012-5358

CRITICAL 9.8CVE-2012-5358 · Published 30/10/2017 · updated 16/06/2026

In short

CVE-2012-5358 is a CRITICAL (CVSS 9.8) vulnerability affecting ektron content management system (ektron).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ektron content management system ektron	`≤ 8.02`	No fix yet

Description

The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or possibly have unspecified other impact via crafted XSL data.

References

documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm · Issue Tracking
technet.microsoft.com/library/security/msvr12-016 · Issue Tracking
webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs · Exploit

CVE-2012-5358

In short

Description

References

More vulnerabilities in ektron content management system

CVE-2012-5358

In short

Description

References

More vulnerabilities in ektron content management system