Log in Start free

Vulnerability · Published Jun 27, 2022 · Assigned by GitHub_M

CVE-2022-31084Unauthenticated Remote Code Execution in ldap-account-manager

Critical 9.0

In plain English

A critical-severity argument injection in lam from LDAPAccountManager. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)9.0Critical
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ldap-account-manager8.0.1-1DEBIAN-CVE-2022-31084
Debian:13ldap-account-manager8.0.1-1DEBIAN-CVE-2022-31084
Debian:14ldap-account-manager8.0.1-1DEBIAN-CVE-2022-31084
Ubuntu:22.04:LTSldap-account-managerno fix listedUBUNTU-CVE-2022-31084
Ubuntu:25.10ldap-account-managerno fix listedUBUNTU-CVE-2022-31084
Ubuntu:26.04:LTSldap-account-managerno fix listedUBUNTU-CVE-2022-31084

Affected products (as reported)

VendorProductVersions
LDAPAccountManager lam < 8.0

Weakness: CWE-88 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References