CVE-2025-58174
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-16

Last updated on: 2025-09-17

Assigner: GitHub, Inc.

Description
LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script (for example a script element). An authenticated user with permission to create or edit a profile can insert a script payload into the profile name and have it executed when the profile data is viewed in a browser. This issue is fixed in version 9.3. No known workarounds are mentioned.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-16
Last Modified
2025-09-17
Generated
2026-05-07
AI Q&A
2025-09-16
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
ldapaccountmanager lam 9.3
ldapaccountmanager lam 8.7
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a stored Cross-Site Scripting (XSS) issue in LDAP Account Manager (LAM) versions before 9.3. It occurs in the Profile section where an authenticated user with permission to create or edit profiles can insert malicious JavaScript code into the profile name field. When the profile data is viewed in a browser, the script executes, potentially allowing the attacker to run arbitrary scripts in the context of the victim user. [1]


How can this vulnerability impact me? :

The vulnerability allows an attacker to execute malicious scripts in the victim's browser when viewing profile data. This can enable the attacker to view information and perform actions within the application as the victim user. However, the severity is considered low because exploitation requires the attacker to have user-level privileges and the user must manually input the malicious script. There is no direct impact on confidentiality, integrity, or availability. [1]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by attempting to create or edit a profile in the LDAP Account Manager (LAM) application and inserting a test script payload such as `<script>alert("XSS")</script>` into the profile name field. If the script executes when viewing the profile, the system is vulnerable. There are no specific network or system commands provided for detection. [1]


What immediate steps should I take to mitigate this vulnerability?

The immediate mitigation step is to upgrade LDAP Account Manager (LAM) to version 9.3 or later, where this stored cross-site scripting vulnerability in the profile name field is fixed. Additionally, restrict profile creation and editing permissions to trusted users to reduce risk until the upgrade is applied. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart