PT-2018-13098 · Reprise · Reprise License Manager

Published 2018-08-20 · Updated 2025-04-30 · CVE-2018-15573

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Reprise License Manager versions through 12.2BL2

Description An issue was discovered in the Reprise License Manager, where attackers can use the web interface to read and write data to any file on disk, as long as rlm.exe has access to it, via the /goform/edit lf process endpoint with file content in the lfdata parameter and a pathname in the lf parameter. The web interface, by default, is on port 5054 and does not require authentication.

Recommendations For versions through 12.2BL2, consider disabling access to the /goform/edit lf process endpoint until a resolution is provided. Restrict access to the web interface on port 5054 to minimize the risk of exploitation. Avoid using the lfdata and lf parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-15573

Affected Products

Reprise License Manager

References · 8

• 🔥 https://bittherapy.net/rce-with-arbitrary-file-write-and-xss-in-reprise-license-manager · Exploit
• https://osv.dev/vulnerability/CVE-2018-15573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15573 · Security Note
• https://t.me/cvenotify/89157 · Telegram Post
• https://t.me/cibsecurity/33791 · Telegram Post
• http://seclists.org/fulldisclosure/2021/Dec/18 · Note
• https://t.me/cvenotify/24386 · Telegram Post
• https://t.me/cvenotify/120402 · Telegram Post