CVE-2021-37498

MediumCVSS 6.5

Published: 20/01/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

An SSRF vulnerability was discovered in the Reprise License Manager (RLM) web interface up to version 14.2BL4. It allows remote attackers to send requests to internal servers and perform port scans via the actserver parameter in the License Activation function.

Risk Assessment

An attacker can exploit this vulnerability to map the internal network infrastructure, discover services, and potentially attack other systems within the organization's internal network.

Recommendation

Immediately update Reprise License Manager to a version newer than 14.2BL4 where this vulnerability is fixed. Until the update, restrict access to the RLM web interface to trusted IP addresses only.

Original NVD description (English source)

An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intranet servers, conduct port scans via the actserver parameter in License Activation function.