Vulnerabilities > CVE-2007-3907 - Authentication Bypass vulnerability in LedgerSMB Login.PL

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
ledgersmb
critical
NVD
Published: 2007-07-19
Updated: 2018-10-15

Summary

Unspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote attackers to bypass authentication and perform certain actions as an arbitrary user via unspecified vectors involving a URL with a redirect parameter value, along with a callback parameter containing an escaped URL that specifies the action.

Vulnerable Configurations

Part Description Count
Application
Ledgersmb
7

References