PT-2007-5131 · Ledgersmb · Ledgersmb

Published 2007-07-19 · Updated 2018-10-15 · CVE-2007-3907

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: LedgerSMB versions 1.2.0 through 1.2.6

Description: The issue allows remote attackers to bypass authentication and perform certain actions as an arbitrary user. This is achieved via unspecified vectors involving a URL with a redirect parameter value, along with a callback parameter containing an escaped URL that specifies the action.

Recommendations: For LedgerSMB versions 1.2.0 through 1.2.6, consider restricting access to the login.pl module to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the redirect and callback parameters in URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-3907

Affected Products

Ledgersmb

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-3907 · Security Note
• http://secunia.com/advisories/26121 · Vendor Advisory
• http://securityfocus.com/archive/1/473993/100/0/threaded · Note
• http://vupen.com/english/advisories/2007/2576 · Note
• http://securityfocus.com/bid/24940 · Note
• http://securityfocus.com/archive/1/473987/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35507 · Note
• http://sourceforge.net/project/shownotes.php?release_id=523576&group_id=175965 · Note
• http://ledgersmb.org/node/52 · Note