CVE-2022-31086

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jun 27, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-310877.8LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versionCVE-2022-310885.3LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versionCVE-2022-310897.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types oCVE-2022-31097.5An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() andCVE-2022-310907.7Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our CuCVE-2022-310917.7Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on mCVE-2022-310928.1Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. ThiCVE-2022-310937.5NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request CVE-2022-310946.1ScratchTools is a web extension designed to make interacting with the Scratch programming language community (Scratching) easier. In affecteCVE-2022-310956.5discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information,CVE-2022-310965.7Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either dCVE-2022-310978.7Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8
CVE-2022-31086: High severity, CVSS 8.8 | Vulnix