CVE-2022-24851

🗓️ 15 Apr 2022 18:45:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 126 Views🌐 WEB

LDAP Account Manager (LAM) open source web frontend for managing LDAP entries. Stored XSS & path traversal vulnerabilities in profile & pdf editor. Requires admin login. Fixed in v7.9.1

Reporter	Title	Published	Views	Family All 25
CNNVD	LDAP Account Manager 跨站脚本漏洞	15 Apr 202200:00	–	cnnvd
CNVD	LDAP Account Manager Cross-Site Scripting Vulnerability	19 Apr 202200:00	–	cnvd
Cvelist	CVE-2022-24851 Stored XSS and path traversal in LDAPAccountManager/lam	15 Apr 202218:45	–	cvelist
Debian	[SECURITY] [DSA 5177-1] ldap-account-manager security update	5 Jul 202218:28	–	debian
Debian CVE	CVE-2022-24851	15 Apr 202218:45	–	debiancve
Tenable Nessus	Debian DSA-5177-1 : ldap-account-manager - security update	6 Jul 202200:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2022-24851	27 Aug 202500:00	–	nessus
EUVD	EUVD-2022-29631	3 Oct 202520:07	–	euvd
Mend	CVE-2022-24851	15 Apr 202218:45	–	mend
NVD	CVE-2022-24851	15 Apr 202219:15	–	nvd

NVD

Vulners

Node

ldap-account-manager ldap_account_managerRange<7.9.1

Node

debian debian_linuxMatch11.0

[
  {
    "product": "lam",
    "vendor": "LDAPAccountManager",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.9.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/LDAPAccountManager/lam/security/advisories/GHSA-f2fr-cccr-583v
debian	www.debian.org/security/2022/dsa-5177
github	www.github.com/LDAPAccountManager/lam/issues/170
github	www.github.com/LDAPAccountManager/lam/commit/3c6f09a3579e048e224eb5a4c4e3eefaa8bccd49

Parameter	Position	Path	Description	CWE
all parameters	request body	/profile/edit	The profile editor tool's parameters are not properly sanitized, allowing an authenticated user to store XSS payloads in profiles.	CWE-22, CWE-79
logoFile	request body	/pdf/edit	The logoFile parameter in the pdf editor tool is not properly sanitized, allowing for path traversal to include local files in exported PDFs.	CWE-22, CWE-79