Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Reprise License Manager Web Interface Password Injection Risk

CVE-2021-37499 · published 3 years ago
Summary

A security weakness in Reprise License Manager's web interface allows hackers to manipulate HTTP headers when a user enters a password. This could be used to trick the system into doing something it shouldn't, potentially leading to unauthorized access. Update to a fixed version of the software to protect against this risk.

What to do
  • Update reprisesoftware reprise_license_manager to version 17.0 or later.
Affected software
VendorProductAffected versions
reprisesoftware reprise_license_manager < 17.0
cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*
Original advisory text
CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote attackers to inject arbitrary HTTP he...
CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote attackers to inject arbitrary HTTP headers.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
Timeline
Published20 Jan 2023
Updated31 Oct 2026
First seen5 Jul 2026
Sources
CVE-2021-37499 · NVD
CVE-2021-37499 · MITRE
Track software like this
Free during beta