CVE-2022-31088: fallo de gravedad media en LDAPAccountManager lam
Unauthenticated LDAP Injection in ldap-account-manager
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 1.3%
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Productos afectados
LDAPAccountManager · lamCVEs relacionadas — LDAPAccountManager lam
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-23333HIGHLAM vulnerable to Authenticated Remote Code ExecutionEPSS 17.8%CVE-2022-31084CRITICALUnauthenticated Remote Code Execution in ldap-account-managerEPSS 2.5%CVE-2022-31086MEDIUMIncorrect Regular Expressions in ldap-account-managerEPSS 2.3%CVE-2022-24851HIGHStored XSS and path traversal in LDAPAccountManager/lamEPSS 1.1%CVE-2024-52792MEDIUMArbitrary config values override in lamEPSS 0.7%CVE-2026-27895MEDIUMLAM has incorrect regular expression in PDF export component that allows user to upload files of any typeEPSS 0.4%