CVE-2018-16405

Vulnerability

Mayan EDMS versions before 3.0.2 contain a reflected cross-site scripting (XSS) vulnerability in the Appearance application. The application sets window.location directly to user-controllable input without proper sanitization, allowing an attacker to inject arbitrary JavaScript code [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that includes the payload in a query parameter processed by the Appearance app. When a victim user with access to Mayan EDMS visits the crafted link, the injected script executes in the context of the victim's session [2]. No authentication or additional privileges are required for the attacker to deliver the payload.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the victim's browser. An attacker can steal session cookies, perform actions on behalf of the victim, deface the application interface, or redirect the user to malicious sites. The scope of the attack is limited to the Mayan EDMS application domain and the victim's browser session [2].

Mitigation

The fix was released in Mayan EDMS version 3.0.2 [1][2]. Users should upgrade to 3.0.2 or later. There is no known workaround for unpatched versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.