CVEvulnerability
CVE-2007-1923
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-04-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.
Affected configurations
• ledgersmb ledgersmb (< 1.3.0)
• sql-ledger sql-ledger
References
- http://osvdb.org/38217 Broken Link
- http://osvdb.org/38218 Broken Link
- http://securityreason.com/securityalert/2552 Third Party Advisory
- http://www.securityfocus.com/archive/1/464880/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/23352 Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 Third Party Advisory, VDB Entry
- https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog Release Notes
- http://osvdb.org/38217 Broken Link
- http://osvdb.org/38218 Broken Link
- http://securityreason.com/securityalert/2552 Third Party Advisory
- http://www.securityfocus.com/archive/1/464880/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/23352 Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33494 Third Party Advisory, VDB Entry
- https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog Release Notes