PT-2019-6735 · Lam · Ldap Account Manager (Lam) Pro

Jan Lieskovsky · Publicado 2019-12-05 · Atualizado 2019-12-12 · CVE-2012-1114

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LDAP Account Manager (LAM) Pro version 3.6

Description A Cross-Site Scripting (XSS) issue exists in the filter parameter to "cmd.php" in an export and exporter id action, and the filteruid parameter to "list.php".

Recommendations For LDAP Account Manager (LAM) Pro version 3.6, consider disabling access to the "cmd.php" and "list.php" scripts until a patch is available, or restrict the use of the filter and filteruid parameters in these scripts to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1114

Produtos afetados

Ldap Account Manager (Lam) Pro

Referências · 14

• https://security-tracker.debian.org/tracker/CVE-2012-1114 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1114 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73971 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089313.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089328.html · Nota
• http://securityfocus.com/bid/52255 · Nota
• https://osv.dev/vulnerability/CVE-2012-1114 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/03/12/10 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1114 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/03/05/24 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1114 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/03/12/1 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089297.html · Nota
• https://t.me/cibsecurity/8535 · Publicação no Telegram