CVE-2022-31087

Name of the Vulnerable Software and Affected Versions LDAP Account Manager versions prior to 8.0

Description The issue allows an attacker to gain code execution on the host by writing a web-shell into the tmp directory, accessible via /lam/tmp/. This directory allows interpretation of .php files, and an attacker with www-data privileges can exploit this. The problem has been fixed in version 8.0.

Recommendations For versions prior to 8.0, disallow executing PHP scripts in the (/var/lib/ldap-account-manager/)tmp directory as a temporary workaround until the issue is resolved. As a permanent solution, upgrade to version 8.0 or later.