CVE-2022-31084: debian debian_linux Argument Injection

Vulnerability summary

CVE-2022-31084 is a critical (CVSS 9.0) Argument Injection vulnerability in debian debian_linux. EPSS estimates a 2.48% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-06-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.