PT-2019-6735 · Lam · Ldap Account Manager (Lam) Pro

Jan Lieskovsky · Published 2019-12-05 · Updated 2019-12-12 · CVE-2012-1114

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LDAP Account Manager (LAM) Pro version 3.6

Description A Cross-Site Scripting (XSS) issue exists in the filter parameter to "cmd.php" in an export and exporter id action, and the filteruid parameter to "list.php".

Recommendations For LDAP Account Manager (LAM) Pro version 3.6, consider disabling access to the "cmd.php" and "list.php" scripts until a patch is available, or restrict the use of the filter and filteruid parameters in these scripts to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1114

Affected Products

Ldap Account Manager (Lam) Pro

References · 14

• https://security-tracker.debian.org/tracker/CVE-2012-1114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1114 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1114 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1114 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73971 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089313.html · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089328.html · Note
• http://securityfocus.com/bid/52255 · Note
• http://openwall.com/lists/oss-security/2012/03/12/10 · Note
• http://openwall.com/lists/oss-security/2012/03/05/24 · Note
• http://openwall.com/lists/oss-security/2012/03/12/1 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089297.html · Note
• https://t.me/cibsecurity/8535 · Telegram Post