LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7647-1 advisory.

    It was discovered that LedgerSMB did not check the origin of HTML fragments. An attacker could possibly     use this issue to send a maliciously crafted URL to the server and obtain sensitive information, or     execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04.
    (CVE-2021-3693)

    It was discovered that LedgerSMB did not properly encode HTML error messages. An attacker could possibly     use this issue to send a maliciously crafted URL to the server and obtain sensitive information, or     execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3694)

    It was discovered that LedgerSMB did not guard against discrete link redirections. An attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and     Ubuntu 18.04 LTS. (CVE-2021-3731)

    It was discovered that LedgerSMB did not properly set the 'Secure' attribute during HTTPS sessions. If a     user were tricked into using an unencrypted connection, an attacker could possibly use this issue to     obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04     LTS, and Ubuntu 25.04. (CVE-2021-3882)

    It was discovered that LedgerSMB could create admin accounts via a URL. If an admin were tricked into     clicking a maliciously crafted URL, an attacker could possibly use this issue to achieve privilege     escalation. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu     25.04. (CVE-2024-23831)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5097-1 advisory.

    It was discovered that LedgerSMB incorrectly handled certain inputs. An attacker could use this to leak     sensitive information, cause a DoS, or execute arbitrary code. (CVE-2021-3693, CVE-2021-3694,     CVE-2021-3731)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-4962 advisory.

    Several vulnerabilities were discovered in LedgerSMB, a financial accounting and ERP program, which could     result in cross-site scripting or clickjacking. For the oldstable distribution (buster), this problem has     been fixed in version 1.6.9+ds-1+deb10u2. For the stable distribution (bullseye), this problem has been     fixed in version 1.6.9+ds-2+deb11u2. We recommend that you upgrade your ledgersmb packages. For the     detailed security status of ledgersmb please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/ledgersmb

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242338	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : LedgerSMB vulnerabilities (USN-7647-1)	Nessus	Ubuntu Local Security Checks	critical
153851	Ubuntu 20.04 LTS : LedgerSMB vulnerabilities (USN-5097-1)	Nessus	Ubuntu Local Security Checks	critical
152775	Debian DSA-4962-1 : ledgersmb - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2021-3693

critical

Tenable Plugins

critical

critical

critical