PT-2022-3278 · Unknown · Ldap Account Manager

Arseniy Sharoglazov · Published 2022-06-16 · Updated 2022-07-15 · CVE-2022-31088

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions LDAP Account Manager versions prior to 8.0

Description The issue exists due to the lack of neutralization of special elements in the LDAP Account Manager web application, allowing a remote attacker to use the username field to enumerate LDAP data. This is only possible in configurations that use LDAP search.

Recommendations For versions prior to 8.0, update to version 8.0 to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation. Avoid using the username field in the affected login endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2022-04002

CVE-2022-31088

DSA-5177-1

GHSA-WXF8-9X99-6GP4

Affected Products

Ldap Account Manager

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31088.json · Exploit
• https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31088 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-31088 · Security Note
• https://debian.org/security/2022/dsa-5177 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04002 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31088 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31088 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31088 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31088 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5177-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31088 · Vendor Advisory
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-wxf8-9x99-6gp4 · Note
• https://t.me/cibsecurity/45236 · Telegram Post
• https://t.me/cvenotify/32739 · Telegram Post