Vulnerability · Published Aug 23, 2021 · Assigned by @huntrdev
CVE-2021-3694Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb
High 8.2
In plain English
A high-severity cross-site scripting in ledgersmb/ledgersmb from ledgersmb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)2.5%top 15.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ledgersmb | 1.6.9+ds-2.1 | DEBIAN-CVE-2021-3694 |
| Ubuntu:22.04:LTS | ledgersmb | 1.6.33+ds-1ubuntu0.1 | USN-7647-1 |
| Ubuntu:24.04:LTS | ledgersmb | 1.6.33+ds-2.1ubuntu0.1 | USN-7647-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ledgersmb | ledgersmb/ledgersmb | unspecified – before 1.8.18 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
References
- https://huntr.dev/bounties/ef7f4cf7-3a81-4516-b261-f5b6ac21430c x_refsource_CONFIRM
- https://github.com/ledgersmb/ledgersmb/commit/98fa476d46a4a7e5e9492ed69b4fa190be5547fc x_refsource_MISC
- https://ledgersmb.org/cve-2021-3694-cross-site-scripting x_refsource_MISC
- DSA-4962 vendor-advisory, x_refsource_DEBIAN