CVE-2021-3693

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
ledgersmbledgersmb/ledgersmb>= unspecified, < 1.8.18

References

Timeline

Published
Aug 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-369305.3Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-369314.4Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2021-369327.5Windows Services for NFS ONCRPC XDR Driver Information Disclosure VulnerabilityCVE-2021-369337.5Windows Services for NFS ONCRPC XDR Driver Information Disclosure VulnerabilityCVE-2021-369347.8An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including CVE-2021-369368.8Windows Print Spooler Remote Code Execution VulnerabilityCVE-2021-369377.8Windows Media MPEG-4 Video Decoder Remote Code Execution VulnerabilityCVE-2021-369385.5Windows Cryptographic Primitives Library Information Disclosure VulnerabilityCVE-2021-36949.6LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user,CVE-2021-369407.6Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-369417.8Microsoft Word Remote Code Execution VulnerabilityCVE-2021-369427.5Windows LSA Spoofing Vulnerability
CVE-2021-3693: Critical severity, CVSS 9.6 | Vulnix