CVE catalog

CVE-2021-3731

LedgerSMB vulnerabilities

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.24% · Oct 25, 2026

LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianledgersmbbookworm1.6.33+ds-2.1fixed
Ubuntuledgersmbnoble1.6.33+ds-2.1ubuntu0.1fixed
Ubuntuledgersmbpro1.4.41+ds-1vulnerable
Ubuntuledgersmbpro1.4.42+ds-1vulnerable
Ubuntuledgersmbpro1.4.42+ds-1ubuntu0.1~esm1fixed
Ubuntuledgersmb20.041.6.9+ds-1vulnerable
Ubuntuledgersmb20.041.6.9+ds-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianledgersmbsourcebookworm1.6.9+ds-2.1not yet assignedNot reported[992817]
Ubuntuledgersmbdebnoble1.6.33+ds-2.1ubuntu0.1Not reportedNot reportedNot reported
Ubuntuledgersmbdebpro1.4.42+ds-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2021-3731Not reported
Ubuntuledgersmbdeb20.041.6.9+ds-1ubuntu0.1Not reportedUBUNTU-CVE-2021-3731Not reported

[Debian bug #992817]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ledgersmb]Fixed
    Details (2)

    • 1.6.33+ds-2.1 · all · bookworm

      Fixed · Fixed: 1.6.9+ds-2.1

      usn · ledgersmb · debian · bookworm; usn · ledgersmb · debian · 12

    • 1.6.33+ds-2.1 · all · bookworm

      Fixed · Fixed: 1.6.9+ds-2.1

      usn · ledgersmb · debian · bookworm; usn · ledgersmb · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]