« Volver al listado

CVE-2015-0931

Estado: ModificadaMedia (6.8)—

Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ektron — Ektron Content Management System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-0931",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-02-14T03:01:19.033",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/377644",
      "tags": [
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/377644",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a \"resource injection\" issue."
    },
    {
      "lang": "es",
      "value": "Ektron Content Management System (CMS) 8.5 y 8.7 anterior a 8.7sp2 y 9.0 anterior a sp1, cuando el analizador de sintaxis Saxon XSLT está utilizado, permite a atacantes remotos ejecutar código arbitrario a través de un documento XSLT manipulado, relacionado con un problema de una 'inyección de recursos'."
    }
  ],
  "lastModified": "2026-06-17T00:21:10.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ektron:ektron_content_management_system:8.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CE05608-CA88-4EC1-A99B-57CBC3F82E43"
            },
            {
              "criteria": "cpe:2.3:a:ektron:ektron_content_management_system:8.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "680BB0D0-703E-4858-B96F-E046B5F8007E"
            },
            {
              "criteria": "cpe:2.3:a:ektron:ektron_content_management_system:8.7.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "798E5E7C-390A-45E1-BD66-F38877A895D5"
            },
            {
              "criteria": "cpe:2.3:a:ektron:ektron_content_management_system:8.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7229DF65-AD95-45E6-AE9F-283CD955F0F1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}