Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team team@security.debian.org Control: found -1 1.6.9+ds-2+deb11u3

Hi,

The following vulnerability was published for ledgersmb.

CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9.

If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-qx... [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c0127...

Regards, Salvatore