PT-2024-13077 · Reprise · Reprise License Manager

Mohaiman Rahim · Published 2024-02-03 · Updated 2025-05-15 · CVE-2023-43183

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Reprise License Manager version 15.1

Description The issue allows read-only users to arbitrarily change the password of an admin and hijack their account due to incorrect access control in Reprise License Management Software.

Recommendations For Reprise License Manager version 15.1, consider restricting access to password change functionality for read-only users until a patch is available. As a temporary workaround, monitor account activity closely to detect potential hijacking attempts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-43183

Affected Products

Reprise License Manager

References · 10

• 🔥 http://seclists.org/fulldisclosure/2024/Jan/43 · Exploit
• 🔥 https://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html · Exploit
• https://osv.dev/vulnerability/CVE-2023-43183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43183 · Security Note
• https://t.me/cvenotify/122437 · Telegram Post
• https://t.me/cvenotify/71164 · Telegram Post
• https://twitter.com/CVEnew/status/1753699439124873694 · Twitter Post
• http://packetstormsecurity.com/files/176841/Reprise-License-Manager-15.1-Privilege-Escalation-File-Write.html · Note
• https://t.me/cvenotify/120399 · Telegram Post
• https://t.me/cvenotify/69932 · Telegram Post