Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / mayan-edms/PYSEC-2014-110
Advisory ID pypa/mayan-edms/PYSEC-2014-110
Aliases CVE-2014-3840
GHSA-wpvx-26f7-65q3
PYSEC-2014-110
Summary Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
http://research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt
http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi
http://seclists.org/oss-sec/2014/q2/349
http://seclists.org/oss-sec/2014/q2/352
https://github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72
https://github.com/mayan-edms/mayan-edms/issues/3
http://www.exploit-db.com/exploits/33493
http://www.securityfocus.com/bid/67552
GHSA-wpvx-26f7-65q3 https://github.com/advisories/GHSA-wpvx-26f7-65q3
Data source Exploit-DB
Date added May 29, 2014
Description Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities
Ransomware campaign use Known
Source publication date May 24, 2014
Exploit type webapps
Platform multiple
Source update date May 29, 2014

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.