CVE-2007-1923 (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct r...
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ledgersmb | < 1.3.0 | 1.3.0 |
| sql-ledger | All versions | No fix listed |
| debian/sql-ledger(Debian:12) | All versions | No fix listed |
| debian/sql-ledger(Debian:12) | = 3.2.6-1 | No fix listed |
| debian/sql-ledger(Debian:13) | All versions | No fix listed |
| debian/sql-ledger(Debian:13) | = 3.2.6-1 | No fix listed |
| debian/sql-ledger(Debian:14) | All versions | No fix listed |
| debian/sql-ledger(Debian:14) | = 3.2.6-1 | No fix listed |
References
- 38217 broken-link vdb-entry
- 38218 broken-link vdb-entry
- 2552 third-party-advisory
- 20070406 ACLS ineffective in SQL-Ledger and LedgerSMB mailing-list third-party-advisory vdb-entry
- 23352 broken-link third-party-advisory vdb-entry
- sqlledger-acl-weak-security(33494) third-party-advisory vdb-entry
- github.com release-notes
- Debian Security Tracker CVE-2007-1923 vendor-advisory
- bugs.debian.org issue-tracking