CVE-2015-0931

Published: Feb 14, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.

Affected (4)

Products: Ektron: Ektron Content Management System

Ektron

1 product

Ektron Content Management System

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ektron Ektron Content Management System	Version 8.5.0
Ektron Ektron Content Management System	Version 8.7.0
Ektron Ektron Content Management System	Version 8.7.0 sp1
Ektron Ektron Content Management System	Version 8.9.0

Related CWEs

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (2)

http://www.kb.cert.org/vuls/id/377644

Source: cret@cert.org

US Government Resource

http://www.kb.cert.org/vuls/id/377644

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

Timeline

No history available yet.