CVE-2021-3694highCWE-79

CVE-2021-3694: falha de alta gravidade em ledgersmb/ledgersmb

Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ledgersmb/ledgersmb+ Monitorar ledgersmb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 2.5%
LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Produtos afetados
ledgersmb · ledgersmb/ledgersmb
CVEs relacionadas — ledgersmb/ledgersmb

No mesmo produto, das mais perigosas para as menos.

CVE-2021-3693HIGHCross-site Scripting (XSS) - DOM in ledgersmb/ledgersmbEPSS 3.2%CVE-2021-3731MEDIUMImproper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbEPSS 1.2%CVE-2021-3882MEDIUMSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmbEPSS 1.1%