CVE-2022-31088
CVE-2022-31088 · Unauthenticated LDAP Injection in ldap-account-manager
This page contains facts from public vulnerability sources. Check the original advisory before updating.
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
CVSS 6.5 · Medium · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
lam
- Versions
- < 8.0: Affected
No fix published
ldap-account-manager Debian:12
- Affected ranges
- ECOSYSTEM: < 8.0.1-1
Update to 8.0.1-1
ldap-account-manager Debian:13
- Affected ranges
- ECOSYSTEM: < 8.0.1-1
Update to 8.0.1-1
ldap-account-manager Debian:14
- Affected ranges
- ECOSYSTEM: < 8.0.1-1
Update to 8.0.1-1
ldap-account-manager Ubuntu:16.04:LTS
- Versions
- 4.9-1
- 5.1-1
- 5.2-1
- 5.2-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ldap-account-manager Ubuntu:18.04:LTS
- Versions
- 5.7-1
- 6.1-1
- 6.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ldap-account-manager Ubuntu:20.04:LTS
- Versions
- 6.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ldap-account-manager Ubuntu:22.04:LTS
- Versions
- 7.5-1
- 7.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ldap-account-manager Ubuntu:25.10
- Versions
- 9.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ldap-account-manager Ubuntu:26.04:LTS
- Versions
- 9.0-1
- 9.0-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published