PT-2009-5864 · Sql Ledger+1 · Sql-Ledger+1

Publicado 2009-12-23 · Atualizado 2018-10-10 · CVE-2009-3581

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SQL-Ledger version 2.8.24

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via specific fields, including the DCN Description field in the Accounts Receivables menu item for Add Transaction, the Description field in the Accounts Payable menu item for Add Transaction, the name field in the Customers menu item for Add Customer, or the Vendor menu item for Add Vendor.

Recommendations For SQL-Ledger version 2.8.24, consider restricting access to the affected fields, such as the DCN Description field, the Description field, and the name fields in the Customers and Vendor menu items, until a patch is available. As a temporary workaround, avoid using these fields for input that may contain web script or HTML.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3581

Produtos afetados

Debian

Sql-Ledger

Referências · 14

• https://nvd.nist.gov/vuln/detail/CVE-2009-3581 · Nota de Segurança
• http://secunia.com/advisories/37877 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-3581 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3581 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-3581 · Aviso do Fabricante
• http://securityfocus.com/archive/1/508559/100/0/threaded · Nota
• https://cve.org/CVERecord?id=CVE-2009-3581 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/sql-ledger · Aviso do Fabricante
• https://packages.debian.org/src:sql-ledger · Nota
• https://ubuntu.com/security/CVE-2009-3581 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3581 · Nota de Segurança
• http://securityfocus.com/bid/37431 · Nota
• https://osv.dev/vulnerability/CVE-2009-3581 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54965 · Nota