CVE-2015-0931

2015-02-1403:01:19

CWE-74

[email protected]

web.nvd.nist.gov

ektron cms

cve-2015-0931

code execution

xslt

security issue

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.8%

JSON

Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a “resource injection” issue.

Affected configurations

NVD

Node

ektronektron_content_management_systemMatch8.5.0

ektronektron_content_management_systemMatch8.7.0

ektronektron_content_management_systemMatch8.7.0sp1

ektronektron_content_management_systemMatch8.9.0

CPENameOperatorVersion
ektron:ektron_content_management_systemektron ektron content management systemeq8.5.0
ektron:ektron_content_management_systemektron ektron content management systemeq8.7.0
ektron:ektron_content_management_systemektron ektron content management systemeq8.9.0

CPE	Name	Operator	Version
ektron:ektron_content_management_system	ektron ektron content management system	eq	8.5.0
ektron:ektron_content_management_system	ektron ektron content management system	eq	8.7.0
ektron:ektron_content_management_system	ektron ektron content management system	eq	8.9.0