HIGH🇵🇱 Wersja polska

CVE-2007-1923

CVSS 7.5v2.0pub. 2007-04-10upd. 2026-04-23

(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.

CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Ledgersmb

    APP
    Ledgersmb
    < 1.3.0

  • Sql Ledger

    APP
    Sql-Ledger
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2018-9246CRITICAL9.8PL ✓same product

Command injection w PGObject::Util::DBAdmin — wstrzyknięcie kodu powłoki

CVE-2024-23831HIGH7.5same product

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an a...

CVE-2021-3693HIGH8.8same product

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially cr...

CVE-2021-3694HIGH8.2same product

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted...

CVE-2009-4402HIGH7.5same product

The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative o...