CVE-2022-31084: Unauthenticated Remote Code Execution in ldap-account-manager
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31084?
CVE-2022-31084 is considered a medium severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2022-31084?
To fix CVE-2022-31084, upgrade your LDAP Account Manager to version 8.0.1-0+deb11u1 or 8.3-1 or later.
What are the affected versions for CVE-2022-31084?
CVE-2022-31084 affects LDAP Account Manager versions prior to 8.0.
Can CVE-2022-31084 be exploited remotely?
Yes, CVE-2022-31084 can be exploited remotely if the affected software is accessible over a network.
What platforms are impacted by CVE-2022-31084?
CVE-2022-31084 impacts LDAP Account Manager running on Debian Linux versions prior to 11.0.