CVE-2021-37498
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An SSRF vulnerability was discovered in the Reprise License Manager (RLM) web interface up to version 14.2BL4. It allows remote attackers to send requests to internal servers and perform port scans via the actserver parameter in the License Activation function.
Risk Assessment
An attacker can exploit this vulnerability to map the internal network infrastructure, discover services, and potentially attack other systems within the organization's internal network.
Recommendation
Immediately update Reprise License Manager to a version newer than 14.2BL4 where this vulnerability is fixed. Until the update, restrict access to the RLM web interface to trusted IP addresses only.
Other vulnerabilities in Reprise License Manager
See all- CVE-2021-37500High
A directory traversal vulnerability in the Reprise License Manager (RLM) web interface before version 14.2BL4 in the diagnostics function allows RLM users with sufficient privileges to overwrite any file on the server.
- CVE-2021-37499Medium
CRLF vulnerability in the Reprise License Manager (RLM) web interface through version 14.2BL4 in the password parameter of the View License Result function allows remote attackers to inject arbitrary HTTP headers.
- CVE-2021-45422Medium
Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.
Original NVD description (English source)
An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intranet servers, conduct port scans via the actserver parameter in License Activation function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS