Security

This document outlines the security weaknesses found or published for Mayan EDMS along with the information about when and in what version these issues were fixed.

CVE-2022-47419

Description: The select2 template used to display tags in the attach and remove view did not performed complete tag label sanitation and allowed cross-site scripting (XSS) to occur.

This is a limited scope weakness and can only be used at best to perform phishing attacks. However this action requires for an attacker to have a user account and be a trusted user with the necessary permissions to create or edit tags.

Any usage of this weakness remains logged in the event system making it easy to track down any bad actors.

Visitors to a Mayan EDMS installation cannot exploit this weakness.

It is not possible to circumvent Mayan EDMS access control system or expose arbitrary information with this weakness.

Contrary to some incorrect reports, it is not possible to exploit this weakness to steal the session cookie and impersonate users. Since version 1.4 (March 23, 2012) Django has included the httponly attribute for the session cookie. This means that the session cookie data, including sessionid, is no longer accessible from JavaScript. https://docs.djangoproject.com/en/4.1/releases/1.4/

Mayan EDMS currently uses Django 3.2. Under this version of Django The SESSION_COOKIE_HTTPONLY defaults to True, which enables the httponly for the session cookie making it inaccessible to JavaScript and therefore not available for impersonation via session hijacking. https://docs.djangoproject.com/en/3.2/ref/settings/#session-cookie-httponly

Django’s SESSION_COOKIE_HTTPONLY setting is not currently exposed by Mayan EDMS’ setting system, therefore it is not possible to disable this protection by conventional means.

Due to all these factors, the surface of attack of this weakness is very limited, if any.

There are no known actual or theoretical attacks exploiting this weakness to expose or destroy data.

Impact: Low

Affected Version: 4.4.2 and earlier

Fixed Version: 4.4.3 (2023-02-11), 4.3.6 (2023-02-19), 4.2.14 (2023-03-09), 4.1.11 (2023-03-08)

CVE-2018-16407

Description: Missing sanitization of the tag label. The tag widget marked the rendered HTML as safe avoiding escaping which allows cross-site scripting (XSS) to occur.

This is a limited scope weakness and can only be used at best to perform phishing attacks. However this action requires for an attacker to have a user account and be a trusted user with the necessary permissions to create or edit tags.

Any usage of this weakness remains logged in the event system making it easy to track down any bad actors.

Visitors to a Mayan EDMS installation cannot exploit this weakness.

It is not possible to circumvent Mayan EDMS access control system or expose arbitrary information with this weakness.

Due to all these factors, the surface of attack of this weakness is very limited, if any.

There are no known actual or theoretical attacks exploiting this weakness to expose or destroy data.

Impact: Low

Affected Version: 3.0.1 and earlier.

Fixed Version: 3.0.2 (2018-08-17)

CVE-2018-16406

Description: Missing sanitization of the cabinet label. The cabinet widget marked the rendered HTML as safe avoiding escaping which allows cross-site scripting (XSS) to occur.

This is a limited scope weakness and can only be used at best to perform phishing attacks. However this action requires for an attacker to have a user account and be a trusted user with the necessary permissions to create or edit cabinets.

Any usage of this weakness remains logged in the event system making it easy to track down any bad actors.

Visitors to a Mayan EDMS installation cannot exploit this weakness.

It is not possible to circumvent Mayan EDMS access control system or expose arbitrary information with this weakness.

Due to all these factors, the surface of attack of this weakness is very limited, if any.

There are no known actual or theoretical attacks exploiting this weakness to expose or destroy data.

Impact: Low

Affected Version: 3.0.1 and earlier.

Fixed Version: 3.0.2 (2018-08-16)

CVE-2018-16405

Description: Missing sanitization of the window.location. The window.location is modified directly to match the view title without HTML escaping which allows cross-site scripting (XSS) to occur.

This is a limited scope weakness and can only be used at best to perform phishing attacks. However this action requires for an attacker to have a user account and be a trusted user with the necessary permissions to create or edit object whose content may be a part of the view title.

Any usage of this weakness remains logged in the event system making it easy to track down any bad actors.

Visitors to a Mayan EDMS installation cannot exploit this weakness.

It is not possible to circumvent Mayan EDMS access control system or expose arbitrary information with this weakness.

Due to all these factors, the surface of attack of this weakness is very limited, if any.

There are no known actual or theoretical attacks exploiting this weakness to expose or destroy data.

Impact: Low

Affected Version: 3.0.1 and earlier.

Fixed Version: 3.0.2 (2018-08-17)

CVE-2014-3840

Description: Missing sanitization of the view title. Authenticated users with object access can create or edit objects with a specially crafted label. Missing HTML escaping allows cross-site scripting (XSS) to occur.

This is a limited scope weakness and can only be used at best to perform phishing attacks. However this action requires for an attacker to have a user account and be a trusted user with the necessary permissions to create or edit object whose content may be a part of the view title.

Any usage of this weakness remains logged in the event system making it easy to track down any bad actors.

Visitors to a Mayan EDMS installation cannot exploit this weakness.

It is not possible to circumvent Mayan EDMS access control system or expose arbitrary information with this weakness.

Due to all these factors, the surface of attack of this weakness is very limited, if any.

There are no known actual or theoretical attacks exploiting this weakness to expose or destroy data.

Impact: Low

Affected Version: 0.12 and earlier.

Fixed Version: 0.13 (2012-12)