Incorrect Regular Expressions in ldap-account-manager
CVE-2022-31086

6.6MEDIUM

Key Information:

Vendor

Ldapaccountmanager

Status
Lam
Vendor
CVE Published:
27 June 2022

What is CVE-2022-31086?

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

lam < 8.0

References

https://github.com/LDAPAccountManager/lam/commit/f1d5d049...
x_refsource_MISC
https://github.com/LDAPAccountManager/lam/security/adviso...
x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5177
vendor-advisoryx_refsource_DEBIAN

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.