LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.
References
| Link | Resource |
|---|---|
| https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 | Patch Third Party Advisory |
| https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982x | Third Party Advisory |
| https://www.debian.org/security/2022/dsa-5177 | Third Party Advisory |
Configurations
History
07 Jul 2022, 14:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 - Patch, Third Party Advisory | |
| References | (DEBIAN) https://www.debian.org/security/2022/dsa-5177 - Third Party Advisory | |
| References | (CONFIRM) https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982x - Third Party Advisory | |
| CPE | cpe:2.3:a:ldap-account-manager:ldap_account_manager:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.0
v3 : 8.8 |
| CWE | CWE-434 |
06 Jul 2022, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Jun 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-27 21:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-31086
Mitre link : CVE-2022-31086
CVE.ORG link : CVE-2022-31086
JSON object : View
Products Affected
debian
- debian_linux
ldap-account-manager
- ldap_account_manager