Vulnerability · Published Aug 23, 2021 · Assigned by @huntrdev
CVE-2021-3693Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb
High 8.8
In plain English
A high-severity cross-site scripting in ledgersmb/ledgersmb from ledgersmb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)3.2%top 11.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ledgersmb | 1.6.9+ds-2.1 | DEBIAN-CVE-2021-3693 |
| Ubuntu:22.04:LTS | ledgersmb | 1.6.33+ds-1ubuntu0.1 | USN-7647-1 |
| Ubuntu:22.04:LTS | ledgersmb | 1.6.33+ds-1ubuntu0.1 | UBUNTU-CVE-2021-3693 |
| Ubuntu:24.04:LTS | ledgersmb | 1.6.33+ds-2.1ubuntu0.1 | USN-7647-1 |
| Ubuntu:24.04:LTS | ledgersmb | 1.6.33+ds-2.1ubuntu0.1 | UBUNTU-CVE-2021-3693 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ledgersmb | ledgersmb/ledgersmb | unspecified – before 1.8.18 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://huntr.dev/bounties/daf1384d-648a-43fd-9b35-5c37d8ead667 x_refsource_CONFIRM
- https://ledgersmb.org/cve-2021-3693-cross-site-scripting x_refsource_MISC
- DSA-4962 vendor-advisory, x_refsource_DEBIAN