CVE-2022-31085 Missing Encryption of Sensitive Data in ldap-account-manager

Medium 5.5 Published 27 Jun 2022 Updated 23 Apr 2025

Attackers can read LDAP credentials from session files if PHP OpenSSL is missing or encryption is disabled, exposing sensitive directory access details.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-31085?

CVE-2022-31085 is a medium-severity vulnerability in Debian Debian Linux, published on 27 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.

Weakness: CWE-522, CWE-311

Which versions are affected by CVE-2022-31085?

It affects 2 products.

Products include Debian Debian Linux, Ldap-Account-Manager Ldap Account Manager.

How do I fix CVE-2022-31085?

Upgrade to a fixed version.

Is CVE-2022-31085 being exploited?

There is no known exploitation of CVE-2022-31085 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-31085, GHSA-6m3q-5c84-6h6j, UBUNTU-CVE-2022-31085.