PT-2014-9074 · Mayan · Mayan Edms

Publicado 2014-05-27 · Atualizado 2014-05-27

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Mayan EDMS version 0.13

Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via a tag or the title of a source in a Staging folder, the Name field in a bootstrap setup, or the Title field in a smart link or web form.

Recommendations For Mayan EDMS version 0.13, update to a version that fixes the cross-site scripting vulnerabilities. As a temporary workaround, consider restricting access to the calculate form title.html template and limiting user input in the affected fields, such as the title and Name fields, to minimize the risk of exploitation.

Identificadores relacionados

PYSEC-2014-110

Produtos afetados

Mayan Edms

Referências · 9

• https://github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72 · Nota
• https://github.com/mayan-edms/mayan-edms/issues/3 · Nota
• http://securityfocus.com/bid/67552 · Nota
• http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi · Nota
• http://seclists.org/oss-sec/2014/q2/352 · Nota
• http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt · Nota
• http://exploit-db.com/exploits/33493 · Nota
• http://seclists.org/oss-sec/2014/q2/349 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-110 · Aviso do Fabricante