CVE-2012-5358

Critical

Published: 30/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The XSLTCompiledTransform function in Ektron Content Management System (CMS) before version 8.02 SP5 configures the XSL with enableDocumentFunction set to true. This allows remote attackers to read arbitrary files, potentially bypassing authentication, modifying viewstate, causing denial of service, or having unspecified other impacts.

Risk Assessment

Organizations may face serious threats, including unauthorized data access and the potential for system modifications, leading to loss of integrity and availability of services.

Recommendation

It is recommended to update the Ektron CMS to version 8.02 SP5 or later to mitigate this vulnerability. Additionally, consider restricting access to XSLT functions within the system.

Original NVD description (English source)

The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or possibly have unspecified other impact via crafted XSL data.