VulnerabilityModified
CVE-2015-0931
Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.
MEDIUM 6.8EPSS 2.44%
Does this matter?
Lower severity and a low EPSS score (2.44%). Track it; it rarely justifies an emergency change on its own.
Description
Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.44% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- ektron/ektron content management system
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/377644US Government Resource
- http://www.kb.cert.org/vuls/id/377644US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.