CVE-2022-31084: fallo crítico en LDAPAccountManager lam
Unauthenticated Remote Code Execution in ldap-account-manager
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9epss 2.5%
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
LDAPAccountManager · lamCVEs relacionadas — LDAPAccountManager lam
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-23333HIGHLAM vulnerable to Authenticated Remote Code ExecutionEPSS 17.8%CVE-2022-31086MEDIUMIncorrect Regular Expressions in ldap-account-managerEPSS 2.3%CVE-2022-31088MEDIUMUnauthenticated LDAP Injection in ldap-account-managerEPSS 1.3%CVE-2022-24851HIGHStored XSS and path traversal in LDAPAccountManager/lamEPSS 1.1%CVE-2024-52792MEDIUMArbitrary config values override in lamEPSS 0.7%CVE-2026-27895MEDIUMLAM has incorrect regular expression in PDF export component that allows user to upload files of any typeEPSS 0.4%