CVE-2022-31088: Unauthenticated LDAP Injection in ldap-account-manager

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-27 · updated 2026-06-17
Weakness: CWE-74

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.

Affected products

Debian Linux: 11.0
ldap-account-manager Ldap Account Manager: before 8.0 — fixed in 8.0

How to fix

Upgrade to a fixed version: ldap-account-manager Ldap Account Manager 8.0. Check the vendor advisory for mitigations.

References

https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-wxf8-9x99-6gp4
https://www.debian.org/security/2022/dsa-5177
https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4
https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-wxf8-9x99-6gp4
https://www.debian.org/security/2022/dsa-5177

Get alerted when CVE-2022-31088 or the next vulnerability affects your stack