Reprise License Manager up to 12.2BL2 Web Interface rlm.exe lfdata/lf unrestricted upload ⚔ [Disputed]

Summaryinfo

A vulnerability was found in Reprise License Manager up to 12.2BL2. It has been rated as critical. This issue affects some unknown processing of the file rlm.exe of the component Web Interface. Performing a manipulation of the argument lfdata/lf as part of Parameter results in input validation. This vulnerability is cataloged as CVE-2018-15573. It is possible to initiate the attack remotely. There is no exploit available. It is still unclear if this vulnerability genuinely exists. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability classified as critical has been found in Reprise License Manager up to 12.2BL2. This affects an unknown function of the file rlm.exe of the component Web Interface. The manipulation of the argument lfdata/lf as part of a Parameter leads to a input validation vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

** DISPUTED ** An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read and write data to any file on disk (as long as rlm.exe has access to it) via /goform/edit_lf_process with file content in the lfdata parameter and a pathname in the lf parameter. By default, the web interface is on port 5054, and does not require authentication. NOTE: the vendor has stated "We do not consider this a vulnerability."

The weakness was shared 08/20/2018 (Website). It is possible to read the advisory at bittherapy.net. This vulnerability is uniquely identified as CVE-2018-15573 since 08/19/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

The real existence of this vulnerability is still doubted at the moment.

It is possible to mitigate the weakness by firewalling Port 5054.

The entry VDB-123040 is related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Reprise

Name

• License Manager

Version

• 12.2BL2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion