CVE-2022-31086: Incorrect Regular Expressions in ldap-account-manager
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31086?
CVE-2022-31086 is considered a critical vulnerability that allows for remote code execution due to improper regular expression validations.
How do I fix CVE-2022-31086?
To fix CVE-2022-31086, upgrade to LDAP Account Manager version 8.0.1-0+deb11u1 or 8.3-1.
Which versions of LDAP Account Manager are affected by CVE-2022-31086?
CVE-2022-31086 affects LDAP Account Manager versions prior to 8.0.
What types of systems are vulnerable to CVE-2022-31086?
CVE-2022-31086 primarily affects installations of LDAP Account Manager on Debian Linux systems.
Can CVE-2022-31086 lead to data breaches?
Yes, CVE-2022-31086 can lead to remote code execution, potentially allowing attackers to breach sensitive data.