LDAP Account Manager Cross-Site Scripting Vulnerability (CNVD-2022-53547)

LDAP Account Manager is a web front-end for managing entries (e.g., users, groups, DHCP settings) stored in the LDAP directory. cross-site scripting vulnerability exists in LDAP Account Manager (LAM) versions prior to 8.0, which stems from the fact that if the PHP OpenSSL extension is not installed or configured with encryption disabled, the Session files contain LDAP user names and passwords in plaintext, which can be exploited to obtain sensitive information.