CVE-2012-5358

CVE-2012-5358 describes a critical vulnerability in Ektron Content Management System (CMS) versions prior to 8.02 SP5. The XSLTCompiledTransform function incorrectly enables the document() function, allowing remote attackers to supply crafted XSL data. This flaw enables arbitrary file reading, which can lead to authentication bypass, viewstate modification, denial of service, and potentially other severe impacts. The vulnerability carries a CVSS score of 9.8 (Critical), indicating it is easily exploitable over the network with low attack complexity and no user interaction required, resulting in high impacts to confidentiality, integrity, and availability. Its EPSS score is low, suggesting a low probability of exploitation, despite a high FAUCET Risk Score. There is no evidence of active exploitation (not in KEV) and no public exploit code available in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness among security researchers, though it has received no media coverage.