Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 1.6.9+ds-2+deb11u3
Hi, The following vulnerability was published for ledgersmb. CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-qxjm [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c0127bf30ef4165 Regards, Salvatore
