CVE-2022-31088: Unauthenticated LDAP Injection in ldap-account-manager
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31088?
CVE-2022-31088 has been classified as a moderate severity vulnerability due to the potential for LDAP data enumeration.
How do I fix CVE-2022-31088?
To fix CVE-2022-31088, upgrade to LDAP Account Manager version 8.0.1-0+deb11u1 or 8.3-1.
Which LDAP Account Manager versions are affected by CVE-2022-31088?
LDAP Account Manager versions prior to 8.0 are affected by CVE-2022-31088.
What type of configuration allows exploitation of CVE-2022-31088?
CVE-2022-31088 can be exploited only if the LDAP search configuration is improperly set.
Is CVE-2022-31088 specific to any operating system?
Yes, CVE-2022-31088 specifically affects users of Debian Linux 11.0.