CVE-2018-12596

CVE-2018-12596 Ektron CMS 9.20 SP2では、リモート攻撃者が「activateuser.aspx」ページを介してaspxページを呼び出すことができます。たとえそのページが/WorkArea/パス以下に配置されていても可能です。このパスは通常はローカル管理者のみが利用可能で、アクセスが禁止されています。 Exploit-DBでの公開は https://www.exploit-db.com/exploits/45577/ PacketStormでの公開は...

CVE-2018-12596

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden normally available exclusively for local...

CVE-2018-12596

CVE-2018-12596 affects Episerver/Ektron CMS (notably version 9.20 SP2) where remote attackers can reach the activateuser.aspx page, even when located under /WorkArea/ (normally restricted to local admins). The vulnerability is caused by improper access restrictions, permitting unauthorized enabli...

CVE-2016-6133

Cross-site scripting XSS vulnerability in Ektron Content Management System before 9.1.0.184SP39.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx...