Vulnerabilities

TI-2021-02664 CVE-2021-3731 · GHSA-vj43-qmpm-3qqp

Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb

LOW 29

LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'.

CVSS 3.1MEDIUM 5.9 Network No auth User interaction EPSS 0.01236 Published 2021-08-23 Fixed in 1.7.33, 1.8.18 CWE-1021

TI-2021-02629 CVE-2021-3694 · GHSA-5wc4-gq9m-293h

MEDIUM 46

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02509 Published 2021-08-23 Fixed in 1.7.33, 1.8.18 CWE-79

TI-2021-02628 CVE-2021-3693 · GHSA-x27f-prq2-qwh6

MEDIUM 47

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0317 Published 2021-08-23 Fixed in 1.7.33, 1.8.18 CWE-79