Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue in LDAP Account Manager (LAM) versions before 9.3. It occurs in the Profile section where an authenticated user with permission to create or edit profiles can insert malicious JavaScript code into the profile name field. When the profile data is viewed in a browser, the script executes, potentially allowing the attacker to run arbitrary scripts in the context of the victim user. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to execute malicious scripts in the victim's browser when viewing profile data. This can enable the attacker to view information and perform actions within the application as the victim user. However, the severity is considered low because exploitation requires the attacker to have user-level privileges and the user must manually input the malicious script. There is no direct impact on confidentiality, integrity, or availability. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to create or edit a profile in the LDAP Account Manager (LAM) application and inserting a test script payload such as `<script>alert("XSS")</script>` into the profile name field. If the script executes when viewing the profile, the system is vulnerable. There are no specific network or system commands provided for detection. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade LDAP Account Manager (LAM) to version 9.3 or later, where this stored cross-site scripting vulnerability in the profile name field is fixed. Additionally, restrict profile creation and editing permissions to trusted users to reduce risk until the upgrade is applied. [1]

Useful 0 Not Useful 0