EPiServer Ektron CMS up to 9.1.0.184 SP2 WorkArea/content.aspx ContType cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in EPiServer Ektron CMS up to 9.1.0.184 SP2. The affected element is an unknown function of the file WorkArea/content.aspx. Performing a manipulation of the argument ContType as part of Parameter results in cross site scripting. This vulnerability is cataloged as CVE-2016-6201. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in EPiServer Ektron CMS up to 9.1.0.184 SP2 (Content Management System). This affects an unknown functionality of the file WorkArea/content.aspx. The manipulation of the argument ContType as part of a Parameter leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Cross-site scripting (XSS) vulnerability in Ektron Content Management System (CMS) before 9.1.0.184 SP3 (9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx.

The bug was discovered 07/04/2016. The weakness was shared 07/03/2017 as File 143014/Ekt (Packetstorm). It is possible to read the advisory at packetstormsecurity.com. This vulnerability is uniquely identified as CVE-2016-6201 since 07/12/2016. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 364 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:WorkArea/content.aspx it is possible to find vulnerable targets with Google Hacking.

Applying the patch 9.1.0.184 SP3 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• EPiServer

Name

• Ektron CMS

Version

• 9.1.0.184 SP2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion