CVE-2021-3731
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
- Record
CVE-2021-3731- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-1021
- Updated
- 2026-11-02
EUVDEUVD-2021-27008
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
- Record
EUVD-2021-27008- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vj43-qmpm-3qqp No score
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable...
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
- Record
GHSA-vj43-qmpm-3qqp- Weakness
- CWE-1021
- Updated
- 2026-11-02
NVD
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
- Record
CVE-2021-3731- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-1021
- Updated
- 2026-11-02
OSV
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
- Record
CVE-2021-3731- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3731
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
- Record
DEBIAN-CVE-2021-3731- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3731
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.
- Record
UBUNTU-CVE-2021-3731- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUSN-5097-1 No score
ledgersmb vulnerabilities
It was discovered that LedgerSMB incorrectly handled certain inputs. An attacker could use this to leak sensitive information, cause a DoS, or execute arbitrary code. (CVE-2021-3693, CVE-2021-3694, CVE-2021-3731)
- Record
USN-5097-1- Updated
- 2026-11-02
OSVUSN-7647-1 No score
ledgersmb vulnerabilities
It was discovered that LedgerSMB did not check the origin of HTML fragments. An attacker could possibly use this issue to send a maliciously crafted URL to the server and obtain sensitive information, or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2021-3693)
It was discovered that LedgerSMB did not properly encode HTML error messages. An attacker could possibly use this issue to send a maliciously crafted URL to the server and obtain sensitive information, or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3694)
It was discovered that LedgerSMB did not guard against discrete link redirections. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2021-3731)
It was discovered that LedgerSMB did not properly set the 'Secure' attribute during HTTPS sessions. If a user were tricked into using an unencrypted connection, an attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2021-3882)
It was discovered that LedgerSMB could create admin accounts via a URL. If an admin were tricked into clicking a maliciously crafted URL, an attacker could possibly use this issue to achieve privilege escalation. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2024-23831)
- Record
USN-7647-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ledgersmbDebian:12 |
before 1.6.9+ds-2.1 | 1.6.9+ds-2.1 |
ledgersmbDebian:10 From an advisory covering 3 CVEs |
before 1.6.9+ds-1+deb10u2, plus listed versions 1.6.9+ds-11.6.9+ds-1+deb10u1 |
1.6.9+ds-1+deb10u2 |
ledgersmbDebian:11 From an advisory covering 3 CVEs |
before 1.6.9+ds-2+deb11u2, plus listed versions 1.6.9+ds-21.6.9+ds-2+deb11u1 |
1.6.9+ds-2+deb11u2 |
ledgersmbUbuntu:Pro:16.04:LTS |
before 1.3.46-1ubuntu0.1~esm1, plus listed versions 1.3.46-1 |
1.3.46-1ubuntu0.1~esm1 |
ledgersmbUbuntu:Pro:18.04:LTS |
before 1.4.42+ds-1ubuntu0.1~esm1, plus listed versions 1.4.41+ds-11.4.42+ds-1 |
1.4.42+ds-1ubuntu0.1~esm1 |
ledgersmbUbuntu:20.04:LTS |
before 1.6.9+ds-1ubuntu0.1, plus listed versions 1.6.9+ds-1 |
1.6.9+ds-1ubuntu0.1 |
ledgersmbUbuntu:20.04:LTS From an advisory covering 3 CVEs |
before 1.6.9+ds-1ubuntu0.1, plus listed versions 1.6.9+ds-1 |
1.6.9+ds-1ubuntu0.1 |
ledgersmbUbuntu:Pro:16.04:LTS From an advisory covering 5 CVEs |
before 1.3.46-1ubuntu0.1~esm1, plus listed versions 1.3.46-1 |
1.3.46-1ubuntu0.1~esm1 |
ledgersmbUbuntu:Pro:18.04:LTS From an advisory covering 5 CVEs |
before 1.4.42+ds-1ubuntu0.1~esm1, plus listed versions 1.4.41+ds-11.4.42+ds-1 |
1.4.42+ds-1ubuntu0.1~esm1 |
ledgersmbUbuntu:Pro:20.04:LTS From an advisory covering 5 CVEs |
before 1.6.9+ds-1ubuntu0.1+esm1, plus listed versions 1.6.9+ds-11.6.9+ds-1ubuntu0.1 |
1.6.9+ds-1ubuntu0.1+esm1 |
ledgersmbUbuntu:22.04:LTS From an advisory covering 5 CVEs |
before 1.6.33+ds-1ubuntu0.1, plus listed versions 1.6.9+ds-2.11.6.33+ds-1 |
1.6.33+ds-1ubuntu0.1 |
ledgersmbUbuntu:24.04:LTS From an advisory covering 5 CVEs |
before 1.6.33+ds-2.1ubuntu0.1, plus listed versions 1.6.33+ds-2.1 |
1.6.33+ds-2.1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3731 is a medium vulnerability (CVSS 5.9) in Ledgersmb, published August 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in ledgersmb 1.6.9+ds-2.1.