CVE-2012-5358

The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or possibly have unspecified other impact via crafted XSL data.

• CWE-19

• http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htmIssue Tracking, Vendor Advisory
• https://technet.microsoft.com/library/security/msvr12-016Issue Tracking, Release Notes, Third Party Advisory
• https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/Exploit, Issue Tracking, Third Party Advisory
• http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htmIssue Tracking, Vendor Advisory
• https://technet.microsoft.com/library/security/msvr12-016Issue Tracking, Release Notes, Third Party Advisory
• https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/Exploit, Issue Tracking, Third Party Advisory

Published

Oct 30, 2017

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-5352Java Open Single Sign-On Project Home (JOSSO) allows remote …
• CVE-2012-5353Eduserv OpenAthens SP 2.0 for Java allows remote attackers t…
• CVE-2012-5354Mozilla Firefox before 16.0, Thunderbird before 16.0, and Se…
• CVE-2012-5355welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local u…
• CVE-2012-5356The apt-add-repository tool in Ubuntu Software Properties 0.…
• CVE-2012-5357Ektron Content Management System (CMS) before 8.02 SP5 uses …
• CVE-2012-5359Libavcodec in FFmpeg before 0.11 allows remote attackers to …
• CVE-2012-5360Libavcodec in FFmpeg before 0.11 allows remote attackers to …
• CVE-2012-5361Libavcodec in FFmpeg before 0.11 allows remote attackers to …
• CVE-2012-5362The IPv6 implementation in Microsoft Windows 7 and earlier a…7.5
• CVE-2012-5363The IPv6 implementation in FreeBSD and NetBSD (unknown versi…7.5
• CVE-2012-5364The IPv6 implementation in Microsoft Windows 7 and earlier a…7.5