CVE-2021-37500
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A directory traversal vulnerability in the Reprise License Manager (RLM) web interface before version 14.2BL4 in the diagnostics function allows RLM users with sufficient privileges to overwrite any file on the server.
Risk Assessment
An attacker can overwrite critical system or configuration files, potentially leading to server compromise or disruption of licensing services.
Recommendation
Immediately upgrade Reprise License Manager to version 14.2BL4 or later and restrict RLM user privileges to the minimum necessary.
Other vulnerabilities in Reprise License Manager
See all- CVE-2021-37499Medium
CRLF vulnerability in the Reprise License Manager (RLM) web interface through version 14.2BL4 in the password parameter of the View License Result function allows remote attackers to inject arbitrary HTTP headers.
- CVE-2021-37498Medium
An SSRF vulnerability was discovered in the Reprise License Manager (RLM) web interface up to version 14.2BL4. It allows remote attackers to send requests to internal servers and perform port scans via the actserver parameter in the License Activation function.
- CVE-2021-45422Medium
Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.
Original NVD description (English source)
Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server.