Summary
It was discovered that LedgerSMB incorrectly handled certain inputs. An
attacker could use this to leak sensitive information, cause a DoS, or
execute arbitrary code. (CVE-2021-3693, CVE-2021-3694, CVE-2021-3731)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | ledgersmb | 1.6.9+ds-1ubuntu0.1 |
Vulnerabilities 3
-
High 8.8
Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb
LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
-
High 8.2
Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb
LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
-
Medium 5.9
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.