CVE-2012-5357 Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE p...
CriticalCVSS 9.8
EPSS 67.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ektron content management system | <= 8.02 | No fix listed |
References
- documentation.ektron.com issue-tracking vendor-advisory
- technet.microsoft.com issue-tracking release-notes third-party-advisory
- webstersprodigy.net exploit issue-tracking third-party-advisory
- www.rapid7.com exploit issue-tracking third-party-advisory