CVE-2012-5358

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.91%

Published

Oct 30, 2017

Modified

May 12, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or possibly have unspecified other impact via crafted XSL data.

Weaknesses (CWE)

CWE-19

Affected Products (1)

ektron · ektron_content_management_systemvulnerable

References (6)

http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm

Issue TrackingVendor Advisory

https://technet.microsoft.com/library/security/msvr12-016

Issue TrackingRelease NotesThird Party Advisory

https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/

ExploitIssue TrackingThird Party Advisory

http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm