Vulnerability Details : CVE-2012-5357

Public exploit exists!
Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.
Published 2017-10-30 14:29:00
Updated 2017-11-18 17:39:59
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2012-5357

Exploit prediction scoring system (EPSS) score for CVE-2012-5357

EPSS FAQ
82.60%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2012-5357

  • Ektron 8.02 XSLT Transform Remote Code Execution
    Disclosure Date: 2012-10-16
    First seen: 2020-04-26
    exploit/windows/http/ektron_xslt_exec
    This module exploits a vulnerability in Ektron CMS 8.02 (before SP5). The vulnerability exists due to the insecure usage of XslCompiledTransform, using a XSLT controlled by the user. The module has been tested successfully on Ektron CMS 8.02 over Windows 2003 SP2,

CVSS scores for CVE-2012-5357

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
9.8
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2012-5357

  • Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-5357

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close