SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sql-ledger | Sql-ledger | 2.4.4 (including) | 2.4.4 (including) |
| Sql-ledger | Sql-ledger | 2.4.5 (including) | 2.4.5 (including) |
| Sql-ledger | Sql-ledger | 2.4.6 (including) | 2.4.6 (including) |
| Sql-ledger | Sql-ledger | 2.4.7 (including) | 2.4.7 (including) |
| Sql-ledger | Sql-ledger | 2.4.8 (including) | 2.4.8 (including) |
| Sql-ledger | Sql-ledger | 2.4.9 (including) | 2.4.9 (including) |
| Sql-ledger | Sql-ledger | 2.4.10 (including) | 2.4.10 (including) |
| Sql-ledger | Sql-ledger | 2.4.11 (including) | 2.4.11 (including) |
| Sql-ledger | Sql-ledger | 2.4.12 (including) | 2.4.12 (including) |
| Sql-ledger | Sql-ledger | 2.4.13 (including) | 2.4.13 (including) |
| Sql-ledger | Sql-ledger | 2.4.14 (including) | 2.4.14 (including) |
| Sql-ledger | Sql-ledger | 2.4.15 (including) | 2.4.15 (including) |
| Sql-ledger | Sql-ledger | 2.4.16 (including) | 2.4.16 (including) |
| Sql-ledger | Sql-ledger | 2.6.0 (including) | 2.6.0 (including) |
| Sql-ledger | Sql-ledger | 2.6.1 (including) | 2.6.1 (including) |
| Sql-ledger | Sql-ledger | 2.6.2 (including) | 2.6.2 (including) |
| Sql-ledger | Sql-ledger | 2.6.3 (including) | 2.6.3 (including) |
| Sql-ledger | Sql-ledger | 2.6.4 (including) | 2.6.4 (including) |
| Sql-ledger | Sql-ledger | 2.6.5 (including) | 2.6.5 (including) |
| Sql-ledger | Sql-ledger | 2.6.6 (including) | 2.6.6 (including) |
| Sql-ledger | Sql-ledger | 2.6.7 (including) | 2.6.7 (including) |
| Sql-ledger | Sql-ledger | 2.6.8 (including) | 2.6.8 (including) |
| Sql-ledger | Sql-ledger | 2.6.9 (including) | 2.6.9 (including) |
| Sql-ledger | Sql-ledger | 2.6.10 (including) | 2.6.10 (including) |
| Sql-ledger | Sql-ledger | 2.6.11 (including) | 2.6.11 (including) |
| Sql-ledger | Sql-ledger | 2.6.12 (including) | 2.6.12 (including) |
| Sql-ledger | Sql-ledger | 2.6.13 (including) | 2.6.13 (including) |
| Sql-ledger | Sql-ledger | 2.6.14 (including) | 2.6.14 (including) |
| Sql-ledger | Sql-ledger | 2.6.15 (including) | 2.6.15 (including) |
| Sql-ledger | Sql-ledger | 2.6.16 (including) | 2.6.16 (including) |
| Sql-ledger | Sql-ledger | 2.6.17 (including) | 2.6.17 (including) |
| Sql-ledger | Sql-ledger | 2.6.18 (including) | 2.6.18 (including) |
| Sql-ledger | Sql-ledger | 2.6.19 (including) | 2.6.19 (including) |
| Sql-ledger | Sql-ledger | 2.6.20 (including) | 2.6.20 (including) |
| Sql-ledger | Sql-ledger | 2.6.21 (including) | 2.6.21 (including) |
| Sql-ledger | Sql-ledger | 2.6.22 (including) | 2.6.22 (including) |
| Sql-ledger | Sql-ledger | 2.6.23 (including) | 2.6.23 (including) |
| Sql-ledger | Sql-ledger | 2.6.24 (including) | 2.6.24 (including) |
| Sql-ledger | Sql-ledger | 2.6.25 (including) | 2.6.25 (including) |
| Sql-ledger | Sql-ledger | 2.6.26 (including) | 2.6.26 (including) |
| Sql-ledger | Sql-ledger | 2.6.27 (including) | 2.6.27 (including) |
| Sql-ledger | Sql-ledger | 2.8.0 (including) | 2.8.0 (including) |
| Sql-ledger | Sql-ledger | 2.8.1 (including) | 2.8.1 (including) |
| Sql-ledger | Sql-ledger | 2.8.2 (including) | 2.8.2 (including) |
| Sql-ledger | Sql-ledger | 2.8.3 (including) | 2.8.3 (including) |
| Sql-ledger | Sql-ledger | 2.8.4 (including) | 2.8.4 (including) |
| Sql-ledger | Sql-ledger | 2.8.5 (including) | 2.8.5 (including) |
| Sql-ledger | Sql-ledger | 2.8.6 (including) | 2.8.6 (including) |
| Sql-ledger | Sql-ledger | 2.8.7 (including) | 2.8.7 (including) |
| Sql-ledger | Sql-ledger | 2.8.8 (including) | 2.8.8 (including) |
| Sql-ledger | Sql-ledger | 2.8.9 (including) | 2.8.9 (including) |
| Sql-ledger | Sql-ledger | 2.8.10 (including) | 2.8.10 (including) |
| Sql-ledger | Sql-ledger | 2.8.11 (including) | 2.8.11 (including) |
| Sql-ledger | Sql-ledger | 2.8.12 (including) | 2.8.12 (including) |
| Sql-ledger | Sql-ledger | 2.8.13 (including) | 2.8.13 (including) |
| Sql-ledger | Sql-ledger | 2.8.14 (including) | 2.8.14 (including) |
| Sql-ledger | Sql-ledger | 2.8.15 (including) | 2.8.15 (including) |
| Sql-ledger | Sql-ledger | 2.8.16 (including) | 2.8.16 (including) |
| Sql-ledger | Sql-ledger | 2.8.17 (including) | 2.8.17 (including) |
| Sql-ledger | Sql-ledger | 2.8.18 (including) | 2.8.18 (including) |