Lucene search

[email protected]CVE-2021-37498

HistoryJan 20, 2023 - 12:15 p.m.

CVE-2021-37498

2023-01-2012:15:10

CWE-918

[email protected]

web.nvd.nist.gov

cve-2021-37498

ssrf

reprise license manager

rlm

web interface

outbound requests

intranet servers

port scans

actserver parameter

license activation function

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.1%

JSON

An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound requests to intranet servers, conduct port scans via the actserver parameter in License Activation function.

Affected configurations

NVD

Node

reprisesoftwarereprise_license_managerRange≤14.2bl4

CPENameOperatorVersion
reprisesoftware:reprise_license_managerreprisesoftware reprise license managerle14.2bl4

CPE	Name	Operator	Version
reprisesoftware:reprise_license_manager	reprisesoftware reprise license manager	le	14.2bl4

References

reprise.com

reprisesoftware.com

github.com/blakduk/Advisories/blob/main/Reprise%20License%20Manager/README.md

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.1%

JSON

Related for CVE-2021-37498

nvd1 prion1 cvelist1