PT-2019-6736 · Lam · Ldap Account Manager (Lam) Pro

Jan Lieskovsky · Publicado 2019-12-05 · Atualizado 2019-12-09 · CVE-2012-1115

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LDAP Account Manager (LAM) Pro version 3.6

Description A Cross-Site Scripting (XSS) issue exists in the export, add value form, and dn parameters to "cmd.php" API endpoint. This allows for potential malicious script execution.

Recommendations For LDAP Account Manager (LAM) Pro version 3.6, consider restricting access to the "cmd.php" API endpoint until a patch is available. As a temporary workaround, avoid using the export, add value form, and dn parameters in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1115

Produtos afetados

Ldap Account Manager (Lam) Pro

Referências · 15

• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089297.html · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1115 · Nota
• https://osv.dev/vulnerability/CVE-2012-1115 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73971 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089313.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1115 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089328.html · Nota
• http://securityfocus.com/bid/52255 · Nota
• http://openwall.com/lists/oss-security/2012/03/12/10 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74357 · Nota
• http://openwall.com/lists/oss-security/2012/03/05/24 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-1115 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/03/12/1 · Nota
• https://t.me/cibsecurity/8534 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2012-1115 · Nota de Segurança