id: PYSEC-2018-16
details: An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets
  window.location directly, leading to XSS.
affected:
- package:
    name: mayan-edms-ng
    ecosystem: PyPI
    purl: pkg:pypi/mayan-edms-ng
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.0.2
  versions:
  - "2.8"
  - "3.0"
  - 3.0.1
references:
- type: WEB
  url: https://gitlab.com/mayan-edms/mayan-edms/issues/494
- type: WEB
  url: 
    https://gitlab.com/mayan-edms/mayan-edms/commit/9ebe80595afe4fdd1e2c74358d6a9421f4ce130e
- type: WEB
  url: https://gitlab.com/mayan-edms/mayan-edms/blob/master/HISTORY.rst
- type: ADVISORY
  url: https://github.com/advisories/GHSA-fpcv-j2q9-vqhw
aliases:
- CVE-2018-16405
- GHSA-fpcv-j2q9-vqhw
modified: "2021-06-16T00:03:23.682256Z"
published: "2018-09-03T19:29:00Z"