CVE-2021-3694: XSS
First published: Mon Aug 23 2021(Updated: )
LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/ledgersmb | 1.6.9+ds-1+deb10u3 1.6.9+ds-2+deb11u3 1.6.33+ds-2.1 | |
| Ledgersmb Ledgersmb | >=1.1.0<=1.1.12 | |
| Ledgersmb Ledgersmb | >=1.2.0<=1.2.26 | |
| Ledgersmb Ledgersmb | >=1.3.0<=1.3.47 | |
| Ledgersmb Ledgersmb | >=1.4.0<=1.4.42 | |
| Ledgersmb Ledgersmb | >=1.5.0<=1.5.30 | |
| Ledgersmb Ledgersmb | >=1.6.0<=1.6.33 | |
| Ledgersmb Ledgersmb | >=1.7.0<=1.7.32 | |
| Ledgersmb Ledgersmb | >=1.8.0<=1.8.17 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ledgersmb.org/cve-2021-3694-cross-site-scripting
- https://security-tracker.debian.org/tracker/CVE-2021-3694
- https://github.com/ledgersmb/ledgersmb/commit/98fa476d46a4a7e5e9492ed69b4fa190be5547fc
- https://huntr.dev/bounties/ef7f4cf7-3a81-4516-b261-f5b6ac21430c
- https://www.debian.org/security/2021/dsa-4962
Frequently Asked Questions
What is the vulnerability ID for this LedgerSMB vulnerability?
The vulnerability ID for this LedgerSMB vulnerability is CVE-2021-3694.
What is the severity rating of CVE-2021-3694?
CVE-2021-3694 has a severity rating of critical with a score of 9.6.
What is the impact of CVE-2021-3694?
CVE-2021-3694 can be abused for remote code execution and information disclosure.
Which versions of LedgerSMB are affected by CVE-2021-3694?
LedgerSMB versions 1.6.9+ds-1+deb10u3, 1.6.9+ds-2+deb11u3, and 1.6.33+ds-2.1 are affected by CVE-2021-3694.
How can I fix CVE-2021-3694 in LedgerSMB?
To fix CVE-2021-3694 in LedgerSMB, update to a version that is not affected, such as 1.6.34+ds-1+deb10u1 or later.
- collector/security-tracker-debian
- collector/nvd-index
- package-manager/debian
- vendor/ledgersmb
- canonical/ledgersmb ledgersmb
- version/ledgersmb ledgersmb/1.1.0
- version/ledgersmb ledgersmb/1.1.12
- version/ledgersmb ledgersmb/1.2.0
- version/ledgersmb ledgersmb/1.2.26
- version/ledgersmb ledgersmb/1.3.0
- version/ledgersmb ledgersmb/1.3.47
- version/ledgersmb ledgersmb/1.4.0
- version/ledgersmb ledgersmb/1.4.42
- version/ledgersmb ledgersmb/1.5.0
- version/ledgersmb ledgersmb/1.5.30
- version/ledgersmb ledgersmb/1.6.0
- version/ledgersmb ledgersmb/1.6.33
- version/ledgersmb ledgersmb/1.7.0
- version/ledgersmb ledgersmb/1.7.32
- version/ledgersmb ledgersmb/1.8.0
- version/ledgersmb ledgersmb/1.8.17
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0