« Volver al listado

CVE-2021-3731

Estado: ModificadaMedia (4.7)—

LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Debian — Debian LinuxLedgersmb — Ledgersmb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-3731",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "ledgersmb",
          "product": "ledgersmb/ledgersmb",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.7.33"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "1.8.18",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-23T13:15:08.007",
  "references": [
    {
      "url": "https://huntr.dev/bounties/5664331d-f5f8-4412-8566-408f8655888a",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@huntr.dev"
    },
    {
      "url": "https://ledgersmb.org/cve-2021-3731-clickjacking",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@huntr.dev"
    },
    {
      "url": "https://www.debian.org/security/2021/dsa-4962",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.dev/bounties/5664331d-f5f8-4412-8566-408f8655888a",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ledgersmb.org/cve-2021-3731-clickjacking",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2021/dsa-4962",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions."
    },
    {
      "lang": "es",
      "value": "LedgerSMB no se protege lo suficiente contra la envoltura de otros sitios, haciéndolo vulnerable al \"clickjacking\". Esto permite a un atacante engañar a un usuario objetivo para que ejecute acciones no deseadas."
    }
  ],
  "lastModified": "2026-06-17T04:05:39.350",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84D837D8-9CEB-4DAC-BEF6-CB0D7CBF3730",
              "versionEndIncluding": "1.1.12",
              "versionStartIncluding": "1.1.0"
            },
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAA91816-FE66-4662-A88B-08E45BE54C60",
              "versionEndIncluding": "1.2.26",
              "versionStartIncluding": "1.2.0"
            },
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AD1A858-F378-4C88-AC54-752BC352DA64",
              "versionEndIncluding": "1.3.47",
              "versionStartIncluding": "1.3.0"
            },
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A19049A3-4641-418B-AAB6-5D32D1FD6E28",
              "versionEndIncluding": "1.4.42",
              "versionStartIncluding": "1.4.0"
            },
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EA19A56-9AD1-4EA9-B020-1930106FD308",
              "versionEndIncluding": "1.5.30",
              "versionStartIncluding": "1.5.0"
            },
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C08AEF10-7BF9-4EEC-B7C1-F233FACEDE7F",
              "versionEndIncluding": "1.6.33",
              "versionStartIncluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "720FC128-BEE5-4D7C-86B8-438159E36475",
              "versionEndIncluding": "1.7.32",
              "versionStartIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4CE19F9-DE00-481E-AA8D-0EDD0B139E9B",
              "versionEndIncluding": "1.8.17",
              "versionStartIncluding": "1.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@huntr.dev"
}