CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2012-5357
Critical (9.8) in ektron ektron content management system. EPSS 68% chance of exploitation in the next 30 days.
Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.
Severity
- EPSS
- 68% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-19
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ektron:ektron_content_management_system
References
- http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm
- https://technet.microsoft.com/library/security/msvr12-016
- https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/
- https://www.rapid7.com/db/modules/exploit/windows/http/ektron_xslt_exec
- http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm