PT-2024-19815 · Unknown+1 · Ldap Account Manager+1

Maik-S · Published 2024-03-18 · Updated 2025-12-23 · CVE-2024-23333

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions LDAP Account Manager (LAM) versions prior to 8.7

Description LDAP Account Manager (LAM) is a web frontend for managing entries stored in an LDAP directory. LAM's log configuration allows specifying arbitrary paths for log files. An attacker could exploit this by creating a PHP file and causing LAM to log some PHP code to this file. When the file is then accessed via the web, the code would be executed. The issue is mitigated by the following: an attacker needs to know LAM's master configuration password to change the main settings, and the web server needs write access to a directory that is accessible via the web. LAM itself does not provide any such directories.

Recommendations As a temporary workaround, consider limiting access to LAM configuration pages to authorized users. Update to version 8.7 or later to resolve the issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-23333

GHSA-FM9W-7M7V-WXQV

Affected Products

Debian

Ldap Account Manager

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23333.json · Exploit
• https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-fm9w-7m7v-wxqv · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23333 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23333 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23333 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-23333 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-23333 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-23333 · Vendor Advisory
• https://github.com/LDAPAccountManager/lam/releases/tag/8.7 · Note
• https://twitter.com/VulmonFeeds/status/1769869661544268063 · Twitter Post
• https://twitter.com/CVEnew/status/1769835328121249838 · Twitter Post
• https://t.me/cvedetector/13136 · Telegram Post
• https://t.me/cvenotify/74194 · Telegram Post
• https://t.me/cveNotify/146694 · Telegram Post