PT-2021-24049 · Reprise · Reprise Rlm

Published 2021-12-13 · Updated 2023-08-02 · CVE-2021-44152

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Reprise RLM version 14.2

Description: An issue was discovered where the "/goform/change password process" API endpoint does not verify authentication or authorization, allowing an unauthenticated user to change the password of any existing user. This enables an attacker to change the password of any known user, preventing valid users from accessing the system and granting the attacker full access to that user's account.

Recommendations: For Reprise RLM version 14.2, as a temporary workaround, consider restricting access to the "/goform/change password process" API endpoint until a patch is available. Additionally, monitor user account activity for any suspicious password changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-44152

Affected Products

Reprise Rlm

References · 6

• 🔥 http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-44152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44152 · Security Note
• https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes · Vendor Advisory
• https://reprisesoftware.com/RELEASE_NOTES · Vendor Advisory
• https://t.me/cibsecurity/33793 · Telegram Post