CVE-2007-1923

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2007-1923
(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.securityfocus.com/bid/23352 Broken Link Third Party Advisory VDB Entry
http://securityreason.com/securityalert/2552 Third Party Advisory
http://osvdb.org/38218 Broken Link
http://osvdb.org/38217 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/464880/100/0/threaded Third Party Advisory VDB Entry
https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog Release Notes
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*
cpe:2.3:a:sql-ledger:sql-ledger:-:*:*:*:*:*:*:*
History

02 Feb 2024, 18:26

Type Values Removed Values Added
References
  • (MISC) https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog - Release Notes
References (BID) http://www.securityfocus.com/bid/23352 - (BID) http://www.securityfocus.com/bid/23352 - Broken Link, Third Party Advisory, VDB Entry
References (SREASON) http://securityreason.com/securityalert/2552 - (SREASON) http://securityreason.com/securityalert/2552 - Third Party Advisory
References (BUGTRAQ) http://www.securityfocus.com/archive/1/464880/100/0/threaded - (BUGTRAQ) http://www.securityfocus.com/archive/1/464880/100/0/threaded - Third Party Advisory, VDB Entry
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 - Third Party Advisory, VDB Entry
References (OSVDB) http://osvdb.org/38217 - (OSVDB) http://osvdb.org/38217 - Broken Link
References (OSVDB) http://osvdb.org/38218 - (OSVDB) http://osvdb.org/38218 - Broken Link
First Time Sql-ledger
Sql-ledger sql-ledger
Summary (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.
CPE cpe:2.3:a:dws_systems_inc.:sql-ledger:*:*:*:*:*:*:*:* cpe:2.3:a:sql-ledger:sql-ledger:-:*:*:*:*:*:*:*
Information

Published : 2007-04-10 23:19

Updated : 2024-02-02 18:26

NVD link : CVE-2007-1923

Mitre link : CVE-2007-1923

JSON object : View

Products Affected

sql-ledger

  • sql-ledger

ledgersmb

  • ledgersmb
CWE
NVD-CWE-Other