XSS in Mayan-Edms Mayan Edms
CVE-2014-3840
Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (3) Name field in a bootstrap setup, or Title field in a (4) smart link or (5) web form.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 3.5 (Low). Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.035 (88.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.035 · newest: 0.035 · change: 0.000
Affected products
- Mayan-Edms Mayan Edms — versions 0.13
Weakness classification (CWE)
References
- seclists.org/oss-sec/2014/q2/352 (mailing-list)
- github.com/mayan-edms/mayan-edms/issues/3
- seclists.org/oss-sec/2014/q2/349 (mailing-list)
- research.openflare.org/advisories/OF-2014-09/mayan-edbs-storedxss.txt (Exploit)
- www.exploit-db.com/exploits/33493 (exploit)
- research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi
- www.securityfocus.com/bid/67552 (vdb-entry)
- github.com/mayan-edms/mayan-edms/commit/398c480c10416d76e7c1dcb607e726e8fc988e72 (Exploit, Patch)