CVE-2024-23831 Privilege escalation through CSRF attack on 'setup.pl'
Attackers can trick admins into creating privileged accounts via CSRF in setup.pl, leading to privilege escalation in LedgerSMB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-23831?
CVE-2024-23831 is a high-severity vulnerability in LedgerSMB, published on 2 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used to create a new user account with full application (/login.pl) privileges, leading to privilege escalation. The vulnerability is patched in versions 1.10.30 and 1.11.9.
Weakness: CWE-352
Which versions are affected by CVE-2024-23831?
It affects 1 product.
Products include Ledgersmb Ledgersmb.
How do I fix CVE-2024-23831?
Upgrade to a fixed version.
Is CVE-2024-23831 being exploited?
There is no known exploitation of CVE-2024-23831 in the wild and no public exploit code.
Other vulnerabilities in LedgerSMB
Sources
Also known as DEBIAN-CVE-2024-23831, GHSA-98ff-f638-qxjm, UBUNTU-CVE-2024-23831.