CVE-2007-1923

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2007-1923
(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://osvdb.org/38217 Broken Link
http://osvdb.org/38218 Broken Link
http://securityreason.com/securityalert/2552 Third Party Advisory
http://www.securityfocus.com/archive/1/464880/100/0/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/23352 Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 Third Party Advisory VDB Entry
https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*
cpe:2.3:a:sql-ledger:sql-ledger:-:*:*:*:*:*:*:*
History

02 Feb 2024, 18:26

Type Values Removed Values Added
First Time Sql-ledger sql-ledger
Sql-ledger
CPE cpe:2.3:a:dws_systems_inc.:sql-ledger:*:*:*:*:*:*:*:* cpe:2.3:a:sql-ledger:sql-ledger:-:*:*:*:*:*:*:*
References () http://osvdb.org/38217 - () http://osvdb.org/38217 - Broken Link
References () http://osvdb.org/38218 - () http://osvdb.org/38218 - Broken Link
References () http://securityreason.com/securityalert/2552 - () http://securityreason.com/securityalert/2552 - Third Party Advisory
References () http://www.securityfocus.com/archive/1/464880/100/0/threaded - () http://www.securityfocus.com/archive/1/464880/100/0/threaded - Third Party Advisory, VDB Entry
References () http://www.securityfocus.com/bid/23352 - () http://www.securityfocus.com/bid/23352 - Broken Link, Third Party Advisory, VDB Entry
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 - Third Party Advisory, VDB Entry
References () https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog - () https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog - Release Notes

25 Sep 2023, 05:15

Type Values Removed Values Added
Summary (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.
References
  • (MISC) https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog -
Information

Published : 2007-04-10 23:19

Updated : 2024-02-02 18:26

NVD link : CVE-2007-1923

Mitre link : CVE-2007-1923

CVE.ORG link : CVE-2007-1923

JSON object : View

Products Affected

sql-ledger

  • sql-ledger

ledgersmb

  • ledgersmb
CWE
NVD-CWE-Other