CVE-2024-23831
Assigner: GitHub_M
Published: 2024-02-02T15:34:12.121Z
State: PUBLISHED
title: Privilege escalation through CSRF attack on 'setup.pl'
problemTypes: descriptions: cweId: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
type: CWE
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
affected: vendor: ledgersmb
product: LedgerSMB
versions: version: < 1.10.30
status: affected
version: >= 1.11.0, < 1.11.9
status: affected
descriptions: value: LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent.  This request can be used to create a new user account with full application (/login.pl) privileges, leading to privilege escalation.  The vulnerability is patched in versions 1.10.30 and 1.11.9.

source: advisory: GHSA-98ff-f638-qxjm
discovery: UNKNOWN