PT-2014-5542 · Mayan · Mayan Edms

Published 2014-05-27 · Updated 2022-05-17 · CVE-2014-3840

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Mayan EDMS version 0.13

Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via a tag or the title of a source in a Staging folder, the Name field in a bootstrap setup, or the Title field in a smart link or web form.

Recommendations For Mayan EDMS version 0.13, update to a version that includes a fix for this issue, as using earlier versions poses a risk of arbitrary web script or HTML injection. As a temporary workaround, consider restricting access to the calculate form title.html template and limiting user input in the affected fields, such as the title and Name fields, until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3840

GHSA-WPVX-26F7-65Q3

PYSEC-2014-110

Affected Products

Mayan Edms

References · 15

• 🔥 https://github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72 · Exploit
• 🔥 http://exploit-db.com/exploits/33493 · Exploit
• 🔥 https://exploit-db.com/exploits/33493 · Exploit
• 🔥 http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3840 · Security Note
• https://osv.dev/vulnerability/PYSEC-2014-110 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wpvx-26f7-65q3 · Vendor Advisory
• https://github.com/mayan-edms/Mayan-EDMS · Note
• https://github.com/mayan-edms/mayan-edms/issues/3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mayan-edms/PYSEC-2014-110.yaml · Note
• http://securityfocus.com/bid/67552 · Note
• http://seclists.org/oss-sec/2014/q2/349 · Note
• https://github.com/advisories/GHSA-wpvx-26f7-65q3 · Note
• http://seclists.org/oss-sec/2014/q2/352 · Note
• http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi · Note