Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
Priority LOW 29CWE-1021Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1021.
Summary
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
Why it matters now
EPSS 0.01236 69th percentileScored 2026-11-07
Fix Fixed ledgersmb/ledgersmb (ledgersmb): 1.7.33, 1.8.18
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ledgersmb | ledgersmb/ledgersmb | before 1.8.18 | 1.7.33, 1.8.18 | Patch available | CNA |
- ledgersmb/ledgersmb Vendorledgersmb Affected before 1.8.18 Fixed in 1.7.33, 1.8.18 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:* | 1.1.0 – 1.1.12; 1.2.0 – 1.2.26; 1.3.0 – 1.3.47; 1.4.0 – 1.4.42; 1.5.0 – 1.5.30; 1.6.0 – 1.6.33; 1.7.0 – 1.7.32; 1.8.0 – 1.8.17 | Vulnerable | ledgersmb |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:* Versions 1.1.0 – 1.1.12; 1.2.0 – 1.2.26; 1.3.0 – 1.3.47; 1.4.0 – 1.4.42; 1.5.0 – 1.5.30; 1.6.0 – 1.6.33; 1.7.0 – 1.7.32; 1.8.0 – 1.8.17 Vulnerable ·ledgersmb
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA ledgersmb/ledgersmb (ledgersmb) Fixed in 1.7.33, 1.8.18
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
ledgersmb/ledgersmb — DSA-4962
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-02628 Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmbPriority MEDIUM 47
- TI-2021-02629 Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmbPriority MEDIUM 46
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3731
- 2026-10-03 Alias added: GHSA-vj43-qmpm-3qqp
References
More Ledgersmb vulnerabilities
- TI-2007-01278 Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows… CVSS 2.0HIGH 10.0
- TI-2007-03785 Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote… CVSS 2.0HIGH 10.0
- TI-2021-02628 Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb CVSS 3.1CRITICAL 9.6
- TI-2018-06697 The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through… CVSS 3.0CRITICAL 9.8
- TI-2007-05160 Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS… CVSS 2.0HIGH 10.0
- TI-2021-02629 Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb CVSS 3.1CRITICAL 9.6
Sources
- CVE-2021-3731 · CVE Program
- CVE-2021-3731 · NVD
- FIRST EPSS
- GHSA-vj43-qmpm-3qqp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences