Log in Start free

Vulnerability · Published Jun 27, 2022 · Assigned by GitHub_M

CVE-2022-31087Incorrect Default Permissions in ldap-account-manager

High 7.8

In plain English

A high-severity injection in lam from LDAPAccountManager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.8High
Exploit odds (30 days)0.4%top 61.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ldap-account-manager8.0.1-1DEBIAN-CVE-2022-31087
Debian:13ldap-account-manager8.0.1-1DEBIAN-CVE-2022-31087
Debian:14ldap-account-manager8.0.1-1DEBIAN-CVE-2022-31087
Ubuntu:22.04:LTSldap-account-managerno fix listedUBUNTU-CVE-2022-31087
Ubuntu:25.10ldap-account-managerno fix listedUBUNTU-CVE-2022-31087
Ubuntu:26.04:LTSldap-account-managerno fix listedUBUNTU-CVE-2022-31087

Affected products (as reported)

VendorProductVersions
LDAPAccountManager lam < 8.0

Weakness: CWE-74 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References