CVE-2022-31084

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.

LDAP Account Manager (LAM) es un frontend web para administrar entradas (por ejemplo, usuarios, grupos, configuraciones DHCP) almacenadas en un directorio LDAP. En versiones anteriores a 8.0, se presentan casos en los que LAM instanciaba objetos de clases arbitrarias. Un atacante puede inyectar el primer argumento del constructor. Esto puede conllevar a una ejecución de código si son instanciadas clases no LAM que ejecutan código durante la creación del objeto. Este problema ha sido corregido en versión 8.0