CVE-2022-31088: medium-severity vulnerability in LDAPAccountManager lam
Unauthenticated LDAP Injection in ldap-account-manager
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 1.3%
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected products
LDAPAccountManager · lamRelated CVEs — LDAPAccountManager lam
In the same product, most dangerous first.
CVE-2024-23333HIGHLAM vulnerable to Authenticated Remote Code ExecutionEPSS 17.8%CVE-2022-31084CRITICALUnauthenticated Remote Code Execution in ldap-account-managerEPSS 2.5%CVE-2022-31086MEDIUMIncorrect Regular Expressions in ldap-account-managerEPSS 2.3%CVE-2022-24851HIGHStored XSS and path traversal in LDAPAccountManager/lamEPSS 1.1%CVE-2024-52792MEDIUMArbitrary config values override in lamEPSS 0.7%CVE-2026-27895MEDIUMLAM has incorrect regular expression in PDF export component that allows user to upload files of any typeEPSS 0.4%