CVE-2012-5357

KRITISCH 9.8CVE-2012-5357 · Published 30/10/2017 · updated 16/06/2026

Package	Affected versions	Patched versions
ektron content management system ektron	`≤ 8.02`	No fix yet

Description

Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.

References

documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm · Issue Tracking
technet.microsoft.com/library/security/msvr12-016 · Issue Tracking
webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs · Exploit
rapid7.com/db/modules/exploit/windows/http/ektron_xslt_exec · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free