PT-2015-4979 · Ektron+1 · Ektron Content Management System+1

Matthias Kaiser · Published 2015-02-14 · Updated 2015-02-17 · CVE-2015-0931

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ektron Content Management System (CMS) versions 8.5 through 8.7 before 8.7sp2 Ektron Content Management System (CMS) version 9.0 before sp1

Description The issue allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue, when the Saxon XSLT parser is used.

Recommendations For versions 8.5 through 8.7, update to 8.7sp2 or later to resolve the issue. For version 9.0, update to sp1 or later to resolve the issue.

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2015-0931

Affected Products

Ektron Content Management System

Saxon Xslt Parser

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-0931 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0931 · Note
• http://kb.cert.org/vuls/id/377644 · Note