PT-2018-13099 · Reprise · Reprise License Manager

Published 2018-08-20 · Updated 2025-04-30 · CVE-2018-15574

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Reprise License Manager (RLM) versions through 12.2BL2

Description The issue is related to a cross-site scripting vulnerability in the license editor. It affects the "/goform/edit lf get data" endpoint, specifically the lf parameter, which can be exploited via GET or POST requests. The vendor has stated that they do not consider this a vulnerability.

Recommendations For Reprise License Manager (RLM) versions through 12.2BL2, as a temporary workaround, consider restricting access to the "/goform/edit lf get data" endpoint to minimize the risk of exploitation. Avoid using the lf parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-15574

Affected Products

Reprise License Manager

References · 7

• 🔥 https://bittherapy.net/rce-with-arbitrary-file-write-and-xss-in-reprise-license-manager · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15574 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15574 · Vendor Advisory
• https://t.me/cvenotify/120403 · Telegram Post
• https://t.me/cvenotify/81447 · Telegram Post
• https://reprisesoftware.com/docs/whats-new.html · Note
• https://t.me/cvenotify/89158 · Telegram Post