CVE-2021-44153
High
Description
An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables, as demonstrated by an ISV demo "C:\Windows\System32\calc.exe" entry. An attacker can exploit this to run a malicious binary on startup, or when triggering the Reread/Restart Servers function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)
SeverityHigh
CVSS7.2
Exploit probability—
ProductReprisesoftware Reprise License Manager
PublishedDec 13, 2021
First seenDec 13, 2021
How to fix
Update
- reprisesoftware reprise_license_manager17.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| reprisesoftware reprise_license_manager | 14.2 ≤ v < 17.0 | 17.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.