The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-4962 advisory.

  - LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a     specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and     information disclosure. (CVE-2021-3693)

  - LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially     crafted URL to an authenticated user, this flaw can be abused for remote code execution and information     disclosure. (CVE-2021-3694)

  - LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to     'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
    (CVE-2021-3731)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-4962-1 : ledgersmb - security update

critical Nessus Plugin ID 152775

No changelogs found