CVE-2025-58174mediumCWE-79

CVE-2025-58174: fallo de gravedad media en LDAPAccountManager lam

LAM profile editor stored cross-site scripting vulnerability

Publicada el

Seguir esta CVE+ Monitorear lam+ Monitorear ldap-account-manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.6epss 0.2%
LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script (for example a script element). An authenticated user with permission to create or edit a profile can insert a script payload into the profile name and have it executed when the profile data is viewed in a browser. This issue is fixed in version 9.3. No known workarounds are mentioned.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Productos afectados
LDAPAccountManager · lam
CVEs relacionadas — LDAPAccountManager lam

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-23333HIGHLAM vulnerable to Authenticated Remote Code ExecutionEPSS 17.8%CVE-2022-31084CRITICALUnauthenticated Remote Code Execution in ldap-account-managerEPSS 2.5%CVE-2022-31086MEDIUMIncorrect Regular Expressions in ldap-account-managerEPSS 2.3%CVE-2022-31088MEDIUMUnauthenticated LDAP Injection in ldap-account-managerEPSS 1.3%CVE-2022-24851HIGHStored XSS and path traversal in LDAPAccountManager/lamEPSS 1.1%CVE-2024-52792MEDIUMArbitrary config values override in lamEPSS 0.7%