CVE Vulnerabilities

CVE-2022-31088

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Jun 27, 2022 | Modified: Nov 21, 2024
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Ldap_account_manager Ldap-account-manager * 8.0 (excluding)
Ldap-account-manager Ubuntu bionic *
Ldap-account-manager Ubuntu impish *
Ldap-account-manager Ubuntu trusty *
Ldap-account-manager Ubuntu upstream *
Ldap-account-manager Ubuntu xenial *

Potential Mitigations

References