CVE-2022-31086

Publication date 27 June 2022

Last updated 16 July 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.6 · Medium

Score breakdown

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.

Status

Package Ubuntu Release Status
ldap-account-manager 25.10 questing
Needs evaluation
25.04 plucky
Needs evaluation
24.10 oracular
Not affected
24.04 LTS noble
Not affected
23.10 mantic
Not affected
23.04 lunar
Not affected
22.10 kinetic
Not affected
22.04 LTS jammy
Needs evaluation
21.10 impish Ignored end of life
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty Ignored end of standard support, was needs-triage

Severity score breakdown

Parameter Value
Base score 6.6 · Medium
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Other references