CVE-2007-3907 Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote attackers to bypass authentication and perform certain actions as an arbitrary user via unspecified vectors involvi...
HighCVSS 10.0
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote attackers to bypass authentication and perform certain actions as an arbitrary user via unspecified vectors involving a URL with a redirect parameter value, along with a callback parameter containing an escaped URL that specifies the action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ledgersmb | = 1.2.0 | No fix listed |
| ledgersmb | = 1.2.1 | No fix listed |
| ledgersmb | = 1.2.2 | No fix listed |
| ledgersmb | = 1.2.3 | No fix listed |
| ledgersmb | = 1.2.4 | No fix listed |
| ledgersmb | = 1.2.5 | No fix listed |
| ledgersmb | = 1.2.6 | No fix listed |
References
- 26121 third-party-advisory vendor-advisory
- sourceforge.net
- www.ledgersmb.org
- 20070718 Clarifications on LedgerSMB vulnerability with Bugtraq ID:24940 mailing-list
- 20070718 Security Advisory: Login bypass in LedgerSMB 1.2.0 through 1.2.6 mailing-list
- 24940 vdb-entry
- ADV-2007-2576 vdb-entry
- ledgersmb-redirection-security-bypass(35507) vdb-entry