CVE-2018-12596

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden (normally available exclusively for local admins).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
episerverektron_cms
9.00
episerverektron_cms
9.00:sp1
episerverektron_cms
9.00:sp2
episerverektron_cms
9.10
episerverektron_cms
9.10:sp1
episerverektron_cms
9.10:sp2
episerverektron_cms
9.20
episerverektron_cms
9.20:sp1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2018/Oct/15
https://github.com/alt3kx/CVE-2018-12596
https://medium.com/%40alt3kx/ektron-content-management-system-cms-9-20-sp2-remote-re-enabling-users-cve-2018-12596-bdf1e3a05158
https://www.exploit-db.com/exploits/45577/
http://seclists.org/fulldisclosure/2018/Oct/15
https://github.com/alt3kx/CVE-2018-12596
https://medium.com/%40alt3kx/ektron-content-management-system-cms-9-20-sp2-remote-re-enabling-users-cve-2018-12596-bdf1e3a05158
https://www.exploit-db.com/exploits/45577/