CVE-2022-31088

Name of the Vulnerable Software and Affected Versions LDAP Account Manager versions prior to 8.0

Description The issue exists due to the lack of neutralization of special elements in the LDAP Account Manager web application, allowing a remote attacker to use the username field to enumerate LDAP data. This is only possible in configurations that use LDAP search.

Recommendations For versions prior to 8.0, update to version 8.0 to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation. Avoid using the username field in the affected login endpoint until the issue is resolved.