PT-2014-9074 · Mayan · Mayan Edms

Published 2014-05-27 · Updated 2014-05-27

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Mayan EDMS version 0.13

Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via a tag or the title of a source in a Staging folder, the Name field in a bootstrap setup, or the Title field in a smart link or web form.

Recommendations For Mayan EDMS version 0.13, update to a version that fixes the cross-site scripting vulnerabilities. As a temporary workaround, consider restricting access to the calculate form title.html template and limiting user input in the affected fields, such as the title and Name fields, to minimize the risk of exploitation.

Related Identifiers

PYSEC-2014-110

Affected Products

Mayan Edms

References · 9

• https://osv.dev/vulnerability/PYSEC-2014-110 · Vendor Advisory
• https://github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72 · Note
• https://github.com/mayan-edms/mayan-edms/issues/3 · Note
• http://securityfocus.com/bid/67552 · Note
• http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi · Note
• http://seclists.org/oss-sec/2014/q2/352 · Note
• http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt · Note
• http://exploit-db.com/exploits/33493 · Note
• http://seclists.org/oss-sec/2014/q2/349 · Note