Michal Kedzior

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager versions prior to 6.3 **Description** The issue allows for XSS via the `dn` parameter to the "templates/3rdParty/pla/htdocs/cmd.php" URI or the `template` parameter to the "templates/3rdParty/pla/htdocs/cmd.php?cmd=rename form" URI. **Recommendations** For versions prior to 6.3, update to version 6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "cmd.php" endpoint and avoiding the use of the `dn` and `template` parameters in the affected URIs until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LDAP Account Manager versions prior to 6.3 **Description** The issue makes it easier for remote attackers to defeat a CSRF protection mechanism by leveraging logging, as the CSRF token is placed in the `sec token` parameter of a URI. **Recommendations** For versions prior to 6.3, update to version 6.3 or later to resolve the issue.