Security readout for executives and security teams
Plain-English summary
Maian Support Helpdesk 4.3 is reported vulnerable to cross-site request forgery that can create administrator accounts. The advisory also describes unrestricted PHP file upload through FAQ attachments. If this product is deployed, the business risk is unauthorized helpdesk administration and possible broader web-server compromise.
Executive priority
If Maian Support Helpdesk 4.3 is present, prioritize near-term review. The main urgency is unauthorized admin creation and possible PHP upload abuse. First confirm whether the product exists in your environment, then follow vendor guidance or isolate the service.
Technical view
CVE-2020-37091 affects Maian Media Maian Support Helpdesk 4.3. Sources describe CWE-352 CSRF enabling administrative account creation and related FAQ attachment PHP upload exposure. The CVSS 3.1 score is 5.3 medium, but account creation plus upload capability can materially increase real-world impact.
Likely exposure
Exposure is likely limited to organizations running Maian Support Helpdesk 4.3, especially internet-facing instances. The source bundle does not identify other affected versions, fixed versions, or default exposure conditions.
Exploitation context
A public ExploitDB entry exists, but CISA KEV is false and no cited source confirms active exploitation. Sources describe malicious HTML forms and administrative account creation; prerequisites and real-world reliability should be validated against the deployed application.
Researcher notes
Evidence is based on CVE data, VulnCheck, and ExploitDB. No vendor patch version is named in the provided sources. The medium CVSS score may understate operational impact because admin creation and executable upload are described together.
Mitigation direction
- Identify Maian Support Helpdesk deployments and confirm whether version 4.3 is installed.
- Check Maian Support vendor guidance for fixed versions or supported upgrade paths.
- Restrict helpdesk administrative and upload interfaces to trusted networks where feasible.
- Review FAQ attachment upload settings and block executable script uploads if supported.
- Monitor for unauthorized admin accounts and unexpected uploaded PHP files.
Validation and detection
- Inventory public and internal Maian Support URLs and record product version.
- Review administrator user lists for unexpected accounts or recent additions.
- Inspect FAQ attachment storage for unexpected PHP or executable files.
- Check web server logs for anomalous admin creation or FAQ upload activity.
- Verify CSRF protections exist on administrative account creation forms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-37091 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-48386CVE reference · exploit
- Vendor HomepageCVE reference · product
- VulnCheck Advisory: Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)CVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.