Every CVE Search/ Get API key

CVE-2022-31085

Missing Encryption of Sensitive Data in ldap-account-manager

5.5 MediumFix available

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.27%Down 0.6 points since Jun 28, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.5

Missing Encryption of Sensitive Data in ldap-account-manager

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Record
CVE-2022-31085
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-311
Updated
2026-11-02
EUVDEUVD-2022-52742 5.5

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Record
EUVD-2022-52742
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
NVD 6.1

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Record
CVE-2022-31085
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-311, CWE-522
Updated
2026-11-02
OSV 5.5

Missing Encryption of Sensitive Data in ldap-account-manager

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Record
CVE-2022-31085
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-311
Updated
2026-11-02
OSVDEBIAN-CVE-2022-31085 6.1

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Record
DEBIAN-CVE-2022-31085
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSVUBUNTU-CVE-2022-31085 6.1

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Record
UBUNTU-CVE-2022-31085
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ldap-account-manager
Debian:12
 before 8.0.1-1
8.0.1-1
ldap-account-manager
Debian:13
 before 8.0.1-1
8.0.1-1
ldap-account-manager
Debian:14
 before 8.0.1-1
8.0.1-1
ldap-account-manager
Debian:11
From an advisory covering 6 CVEs
 before 8.0.1-0+deb11u1, plus listed versions
7.4-17.5-17.7-17.9-17.9.1-1
8.0.1-0+deb11u1
ldap-account-manager
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.9-15.1-15.2-15.2-1ubuntu1
 None known
ldap-account-manager
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.7-16.1-16.2-1
 None known
ldap-account-manager
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.7-1
 None known
ldap-account-manager
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.5-17.7-1
 None known

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31085 is a medium vulnerability (CVSS 5.5) in Ldap-account-manager Ldap Account Manager, published June 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in ldap-account-manager 8.0.1-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open