CVE-2007-1923

high

Description

(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to access restricted functionality via direct requests. The LedgerSMB affected versions are before 1.3.0.

References

Advisories
More

https://exchange.xforce.ibmcloud.com/vulnerabilities/33494

http://www.securityfocus.com/archive/1/464880/100/0/threaded

http://securityreason.com/securityalert/2552

https://github.com/ledgersmb/LedgerSMB/blob/master/Changelog

https://euvd.enisa.europa.eu/vulnerability/EUVD-2007-1917

http://www.securityfocus.com/bid/23352

http://osvdb.org/38218

http://osvdb.org/38217

Details

Source: Mitre, NVD

Published: 2007-04-10

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

EPSS

EPSS: 0.00973