CVE-2025-58174
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-09-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ldapaccountmanager | lam | 9.3 |
| ldapaccountmanager | lam | 8.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored Cross-Site Scripting (XSS) issue in LDAP Account Manager (LAM) versions before 9.3. It occurs in the Profile section where an authenticated user with permission to create or edit profiles can insert malicious JavaScript code into the profile name field. When the profile data is viewed in a browser, the script executes, potentially allowing the attacker to run arbitrary scripts in the context of the victim user. [1]
How can this vulnerability impact me? :
The vulnerability allows an attacker to execute malicious scripts in the victim's browser when viewing profile data. This can enable the attacker to view information and perform actions within the application as the victim user. However, the severity is considered low because exploitation requires the attacker to have user-level privileges and the user must manually input the malicious script. There is no direct impact on confidentiality, integrity, or availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to create or edit a profile in the LDAP Account Manager (LAM) application and inserting a test script payload such as `<script>alert("XSS")</script>` into the profile name field. If the script executes when viewing the profile, the system is vulnerable. There are no specific network or system commands provided for detection. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade LDAP Account Manager (LAM) to version 9.3 or later, where this stored cross-site scripting vulnerability in the profile name field is fixed. Additionally, restrict profile creation and editing permissions to trusted users to reduce risk until the upgrade is applied. [1]