CVE-2022-31088

Unauthenticated LDAP Injection in ldap-account-manager

6.5 MediumFix available

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: Low

Exploit likelihood

1.31%Up 0.4 points since Jun 28, 2022

What each source reports

CVE List Score used 6.5

Unauthenticated LDAP Injection in ldap-account-manager

Record: CVE-2022-31088
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness: CWE-74
Updated: 2026-11-02

EUVDEUVD-2022-52745 6.5

Record: EUVD-2022-52745
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated: 2026-11-02

NVD 5.3

Record: CVE-2022-31088
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-74
Updated: 2026-11-02

OSV 6.5

Unauthenticated LDAP Injection in ldap-account-manager

Record: CVE-2022-31088
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness: CWE-74
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-31088 5.3

Record: UBUNTU-CVE-2022-31088
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-31088 No score

Record: DEBIAN-CVE-2022-31088
Updated: 2026-11-03

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ldap-account-manager` Debian:12	before 8.0.1-1	8.0.1-1
`ldap-account-manager` Debian:13	before 8.0.1-1	8.0.1-1
`ldap-account-manager` Debian:14	before 8.0.1-1	8.0.1-1
`ldap-account-manager` Debian:11 From an advisory covering 6 CVEs	before 8.0.1-0+deb11u1, plus listed versions 7.4-17.5-17.7-17.9-17.9.1-1	8.0.1-0+deb11u1
`ldap-account-manager` Ubuntu:16.04:LTS	All versions, plus listed versions 4.9-15.1-15.2-15.2-1ubuntu1	None known
`ldap-account-manager` Ubuntu:18.04:LTS	All versions, plus listed versions 5.7-16.1-16.2-1	None known
`ldap-account-manager` Ubuntu:20.04:LTS	All versions, plus listed versions 6.7-1	None known
`ldap-account-manager` Ubuntu:22.04:LTS	All versions, plus listed versions 7.5-17.7-1	None known
`ldap-account-manager` Ubuntu:25.10	All versions, plus listed versions 9.0-1	None known
`ldap-account-manager` Ubuntu:26.04:LTS	All versions, plus listed versions 9.0-19.0-1build1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31088 is a medium vulnerability (CVSS 6.5) in Ldap-account-manager Ldap Account Manager, published June 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in ldap-account-manager 8.0.1-1.