{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-10T21:08:42.412","vulnerabilities":[{"cve":{"id":"CVE-2022-24851","sourceIdentifier":"security-advisories@github.com","published":"2022-04-15T19:15:12.383","lastModified":"2024-11-21T06:51:14.207","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor tool has an edit pdf profile functionality, the logoFile parameter in it is not properly sanitized and an user can enter relative paths like ../../../../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png via tools like burpsuite. Later when a pdf is exported using the edited profile the pdf icon has the image on that path(if image is present). Both issues require an attacker to be able to login to LAM admin interface. The issue is fixed in version 7.9.1."},{"lang":"es","value":"LDAP Account Manager (LAM) es un frontend web de código abierto para administrar las entradas almacenadas en un directorio LDAP. La herramienta de edición de perfiles presenta una funcionalidad de edición de perfiles, los parámetros en esta página no están saneados apropiadamente y por lo tanto conlleva a ataques de tipo XSS almacenados. Un usuario autenticado puede almacenar cargas útiles de tipo XSS en los perfiles, que son desencadenadas cuando cualquier otro usuario intenta acceder a la página de edición de perfiles. La herramienta de edición de pdf presenta una funcionalidad de edición de perfil de pdf, el parámetro logoFile en ella no está correctamente saneado y un usuario puede introducir rutas relativas como ../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png por medio de herramientas como burpsuite. Más tarde, cuando es exportado un pdf usando el perfil editado, el icono del pdf presenta la imagen en esa ruta (si la imagen está presente). Ambos problemas requieren que un atacante sea capaz de acceder a la interfaz de administración de LAM. El problema ha sido corregido en versión 7.9.1"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ldap-account-manager:ldap_account_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"7.9.1","matchCriteriaId":"7FA2D90C-50A8-451A-97D2-7BAC063193F4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"references":[{"url":"https://github.com/LDAPAccountManager/lam/commit/3c6f09a3579e048e224eb5a4c4e3eefaa8bccd49","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/LDAPAccountManager/lam/issues/170","source":"security-advisories@github.com","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-f2fr-cccr-583v","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5177","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/LDAPAccountManager/lam/commit/3c6f09a3579e048e224eb5a4c4e3eefaa8bccd49","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/LDAPAccountManager/lam/issues/170","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-f2fr-cccr-583v","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5177","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}