CVE-2022-31085: debian debian_linux Missing Encryption of Sensitive Data
Vulnerability summary
CVE-2022-31085 is a medium (CVSS 6.1) Missing Encryption of Sensitive Data vulnerability in debian debian_linux. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-06-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
0.00 pp
From 0.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Debian2 products
- ldap-account-manager< 8.0.1-1
- debian_linuxEOL11.0
Ldap-account-manager1 product
- ldap_account_manager< 8.0
Ldapaccountmanager1 product
- lam< 8.0
Ubuntu1 product
- ldap-account-managerAll versions (No fix recorded)
4 vendors · 5 products
References
6 links- github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4X Refsource MISCREPORTPatchThird Party Advisory
- github.com/LDAPAccountManager/lam/security/advisories/GHSA-6m3q-5c84-6h6jX Refsource CONFIRMREPORTThird Party Advisory
