Vulnerability CVE-2015-0923

Vulnerability CVE-2015-0923

Published: 2015-02-13 Modified: 2015-02-14

Description:

The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Ektron 8.5 / 8.7 / 9.0 XSLT Transform Remote Code Execution	catatonicprime	04.03.2017

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5/10	2.9/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	None	None

Affected software
Ektron -> Ektron content management system

References:

http://www.kb.cert.org/vuls/id/377644

Copyright 2024, cxsecurity.com