Vulnerability record · CVE-2024-23831 · published 2 February 2024

CVE-2024-23831: Ledgersmb cross-site request forgery vulnerability

Ledgersmb · Ledgersmb

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used to create a new user account with full application (/login.pl) privileges, leading to privilege escalation. The vulnerability is patched in versions 1.10.30 and 1.11.9.

7.5 CVSS 3.1 High EPSS 0.27% · top 82.2% CWE-352 · Cross-site request forgery

7.5CVSS 3.1 base score

0.27%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ledgersmb Ledgersmb

References

Link	Tags
https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c0127bf30ef4165	Patch
https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-qxjm	Vendor Advisory
https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c0127bf30ef4165	Patch
https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-qxjm	Vendor Advisory

Track CVE-2024-23831 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2007-5372Dws systems inc. sql-ledger sql injection vulnerabilityMultiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbi…EPSS 2.4%11 Oct 2007 10.0CVE-2007-3907Ledgersmb vulnerabilityUnspecified vulnerability in login.pl in LedgerSMB 1.2.0 through 1.2.6 allows remote attackers to bypass authentication and perform certain actions a…EPSS 3.0%19 Jul 2007 10.0CVE-2007-1329Ledgersmb vulnerabilityDirectory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows remote attackers to read and overwrite arbitrary files, and execu…EPSS 5.2%7 Mar 2007 9.8CVE-2018-9246Pgobject-util-dbadmin project pgobject-util-dbadmin vulnerabilityThe PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values u…EPSS 2.6%8 Jun 2018 9.6CVE-2021-3693Ledgersmb cross-site scripting vulnerabilityLedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, thi…EPSS 3.2%23 Aug 2021 9.6CVE-2021-3694Ledgersmb cross-site scripting vulnerabilityLedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this fla…EPSS 2.5%23 Aug 2021 9.0CVE-2007-1437Ledgersmb vulnerabilityUnspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and possibly bypass authe…EPSS 3.4%13 Mar 2007 7.8CVE-2008-4077Ledgersmb uncontrolled resource consumption vulnerabilityThe CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a denial of service (reso…EPSS 2.8%15 Sep 2008

Source: NIST National Vulnerability Database (record CVE-2024-23831), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.