Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb
Priority MEDIUM 47CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
Why it matters now
EPSS 0.0317 88th percentileScored 2026-11-07
Fix Fixed ledgersmb/ledgersmb (ledgersmb): 1.7.33, 1.8.18
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ledgersmb | ledgersmb/ledgersmb | before 1.8.18 | 1.7.33, 1.8.18 | Patch available | CNA |
- ledgersmb/ledgersmb Vendorledgersmb Affected before 1.8.18 Fixed in 1.7.33, 1.8.18 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:* | 1.5.0 – 1.5.30; 1.6.0 – 1.6.33; 1.7.0 – 1.7.32; 1.8.0 – 1.8.17 | Vulnerable | ledgersmb |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:* Versions 1.5.0 – 1.5.30; 1.6.0 – 1.6.33; 1.7.0 – 1.7.32; 1.8.0 – 1.8.17 Vulnerable ·ledgersmb
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA ledgersmb/ledgersmb (ledgersmb) Fixed in 1.7.33, 1.8.18
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
ledgersmb/ledgersmb — DSA-4962
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-02629 Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmbPriority MEDIUM 46
- TI-2021-02664 Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbPriority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3693
- 2026-10-03 Alias added: GHSA-x27f-prq2-qwh6
References
More Ledgersmb vulnerabilities
- TI-2007-01278 Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows… CVSS 2.0HIGH 10.0
- TI-2007-03785 Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote… CVSS 2.0HIGH 10.0
- TI-2018-06697 The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through… CVSS 3.0CRITICAL 9.8
- TI-2007-05160 Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS… CVSS 2.0HIGH 10.0
- TI-2021-02629 Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb CVSS 3.1CRITICAL 9.6
- TI-2007-01379 Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows… CVSS 2.0HIGH 9.0
Sources
- CVE-2021-3693 · CVE Program
- CVE-2021-3693 · NVD
- FIRST EPSS
- GHSA-x27f-prq2-qwh6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences