Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted XSLT stylesheet with "extension elements and extension functions" that trigger code execution by Xalan-Java, as demonstrated using xalan://java.lang.Runtime.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Hannonhill Cascade Server XLST处理远程命令执行漏洞
Vulnerability Description
Cascade Server是一款功能强大的web内容管理(WCM)解决方案。 Cascade Server没有限制用户可访问的某些XSLT代码，可以任何编辑XSLT样式表的用户都可以导致Cascade Server执行任意Java代码。通过使用java.lang.Runtime类，Java可以运行shell命令。 尽管Cascade Server进程的权限级别还不足以完全控制主机系统，但可以控制Cascade Server。
CVSS Information
N/A
Vulnerability Type
N/A