CVE-2007-1923

(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/38217	Broken Link
http://osvdb.org/38218	Broken Link
http://securityreason.com/securityalert/2552	Third Party Advisory
http://www.securityfocus.com/archive/1/464880/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/23352	Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/33494	Third Party Advisory VDB Entry
https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ledgersmb:ledgersmb::::::::
	cpe:2.3:a:sql-ledger:sql-ledger:-:::::::*

History

No history.

Information

Published : 2007-04-10 23:19

Updated : 2024-02-02 18:26

NVD link : CVE-2007-1923

Mitre link : CVE-2007-1923

CVE.ORG link : CVE-2007-1923

JSON object : View

Products Affected

sql-ledger

sql-ledger

ledgersmb

ledgersmb

CWE

NVD-CWE-Other

{"id": "CVE-2007-1923", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-04-10T23:19:00.000", "references": [{"url": "http://osvdb.org/38217", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/38218", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2552", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/464880/100/0/threaded", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/23352", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33494", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0."}, {"lang": "es", "value": "(1) LedgerSMB y (2) DWS Systems SQL-Ledger implementa las listas de control de acceso a trav\u00e9s del cambio de la asignaci\u00f3n de URLs enlazadas desde men\u00fas, lo cual permite a atacantes remotos acceder a funcionalidades restringidas a trav\u00e9s de una respuesta directa."}], "lastModified": "2024-02-02T18:26:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AEC949D-05C5-46A4-8524-708110C55CD1", "versionEndExcluding": "1.3.0"}, {"criteria": "cpe:2.3:a:sql-ledger:sql-ledger:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA6F3CE1-B130-49E4-BABB-A2C44F955625"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}