CVE-2007-0667

2007-02-0200:00:00

ubuntu.com

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.01 Low

EPSS

Percentile

83.8%

JSON

The redirect function in Form.pm for (1) LedgerSMB before 1.1.5 and (2)
SQL-Ledger allows remote authenticated users to execute arbitrary code via
redirects, related to callbacks, a different issue than CVE-2006-5872.

Notes

Author	Note
sbeattie	hard to determine if this was fixed in newer releases; see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=409703
ebarretto	We won’t be patching it in esm-apps/xenial as this bug never got fixed and a separate fork of such project was created.