Published: 10/10/2018 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Episerver Ektron CMS prior to 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote malicious users to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden (normally available exclusively for local admins).

Vulnerable Product	Search on Vulmon	Subscribe to Product
episerver ektron cms 9.00
episerver ektron cms 9.10
episerver ektron cms 9.20

Details ================ Software: Ektron Content Management System (CMS) Version: 920 SP2 Homepage: wwwepiservercom Advisory report: githubcom/alt3kx/CVE-2018-12596 CVE: CVE-2018-12596 CVSS: 75 (HIGH: (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) CWE-284 Description ================ Ektron CMS 920 SP2 allows remote attackers to enab ...

Ektron CMS version 920 SP2 suffers from an improper access restriction vulnerability ...

Ektron Content Management System (CMS) 9.20 SP2, remote re-enabling users (CVE-2018–12596)

CVE-2018-12596 Ektron CMS 920 SP2 allows remote attackers to call aspx pages via the "activateuseraspx" page, even if a page is located under the /WorkArea/ path, which is forbidden (normally available exclusively for local admins) Exploit-DB publication at wwwexploit-dbcom/exploits/45577/ PacketStorm publication at packetstormsecuritycom/files/

CWE-269 https://github.com/alt3kx/CVE-2018-12596 http://seclists.org/fulldisclosure/2018/Oct/15 https://www.exploit-db.com/exploits/45577/https://medium.com/%40alt3kx/ektron-content-management-system-cms-9-20-sp2-remote-re-enabling-users-cve-2018-12596-bdf1e3a05158 https://nvd.nist.gov https://github.com/alt3kx/CVE-2018-12596 https://www.exploit-db.com/exploits/45577/

CVE-2018-12596

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect