The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 befo…

published 2015-02-14 11y ago modified 2026-06-17 4mo ago also EUVD-2015-0931

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 22.0%; EPSS 22.0% chance of exploitation in 30 days, percentile 97%
public exploits: 1; Metasploit

The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.

Is CVE-2015-0923 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2015-02-05 First public exploit (Metasploit exploit/windows/http/ektron_xslt_exec_ws)
2015-02-14 Published

Exploit prediction

22.03% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/http/ektron_xslt_exec_ws Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution metasploit exploit, excellent rank, 2015-02-05

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

References

kb.cert.org /vuls/id/377644
third-party-advisory, us-government-resource

Sources

CVE List CVE-2015-0923
NVD CVE-2015-0923

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.