CVE-2015-0923

Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2015-0923 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit.

Description

The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

MetasploitEktron 8.5, 8.7, 9.0 XSLT Transform Remote Code ExecutionMetasploit exploitby catatonicprimeNot analyzed1 file

Ruby

Metasploit
PoC details

References

2