Medium severity5.3NVD Advisory· Published Jun 27, 2022· Updated Jun 17, 2026

CVE-2022-31088

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ldapaccountmanager/LDAP Account Manager2 versions
cpe:2.3:a:ldap-account-manager:ldap_account_manager:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ldap-account-manager:ldap_account_manager:*:*:*:*:*:*:*:*range: <8.0
- (no CPE)range: <8.0
Debian/linux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Ldapaccountmanager/Lamv5
Range: < 8.0

Patches

Vulnerability mechanics

References

github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4nvdPatchThird Party Advisory
github.com/LDAPAccountManager/lam/security/advisories/GHSA-wxf8-9x99-6gp4nvdThird Party Advisory
www.debian.org/security/2022/dsa-5177nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000