CVE-2012-5357

Critical

Published: 30/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Ektron Content Management System (CMS) before version 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, allowing remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.

Risk Assessment

An attacker could exploit this vulnerability to execute malicious code, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to update Ektron CMS to version 8.02 SP5 or later to mitigate this vulnerability.

Original NVD description (English source)

Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.