CVE-2021-37499
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
CRLF vulnerability in the Reprise License Manager (RLM) web interface through version 14.2BL4 in the password parameter of the View License Result function allows remote attackers to inject arbitrary HTTP headers.
Risk Assessment
An attacker can exploit this vulnerability to manipulate HTTP responses, potentially leading to cache poisoning, session fixation, or session hijacking attacks.
Recommendation
Immediately upgrade Reprise License Manager to a version newer than 14.2BL4 that includes a fix for the CRLF vulnerability.
Other vulnerabilities in Reprise License Manager
See all- CVE-2021-37500High
A directory traversal vulnerability in the Reprise License Manager (RLM) web interface before version 14.2BL4 in the diagnostics function allows RLM users with sufficient privileges to overwrite any file on the server.
- CVE-2021-37498Medium
An SSRF vulnerability was discovered in the Reprise License Manager (RLM) web interface up to version 14.2BL4. It allows remote attackers to send requests to internal servers and perform port scans via the actserver parameter in the License Activation function.
- CVE-2021-45422Medium
Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.
Original NVD description (English source)
CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote attackers to inject arbitrary HTTP headers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS