PT-2019-6736 · Lam · Ldap Account Manager (Lam) Pro

Jan Lieskovsky · Published 2019-12-05 · Updated 2019-12-09 · CVE-2012-1115

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LDAP Account Manager (LAM) Pro version 3.6

Description A Cross-Site Scripting (XSS) issue exists in the export, add value form, and dn parameters to "cmd.php" API endpoint. This allows for potential malicious script execution.

Recommendations For LDAP Account Manager (LAM) Pro version 3.6, consider restricting access to the "cmd.php" API endpoint until a patch is available. As a temporary workaround, avoid using the export, add value form, and dn parameters in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1115

Affected Products

Ldap Account Manager (Lam) Pro

References · 15

• https://osv.dev/vulnerability/CVE-2012-1115 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1115 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-1115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1115 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089297.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1115 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73971 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089313.html · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089328.html · Note
• http://securityfocus.com/bid/52255 · Note
• http://openwall.com/lists/oss-security/2012/03/12/10 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74357 · Note
• http://openwall.com/lists/oss-security/2012/03/05/24 · Note
• http://openwall.com/lists/oss-security/2012/03/12/1 · Note
• https://t.me/cibsecurity/8534 · Telegram Post