← Back to CVEs
CVE-2021-44152
CRITICAL9.8
Description
An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.
CVE Details
CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published12/13/2021
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
reprisesoftware:reprise_license_manager
Weaknesses (CWE)
CWE-306
References
http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html(cve@mitre.org)
https://www.reprisesoftware.com/RELEASE_NOTES(cve@mitre.org)
http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html(af854a3a-2127-422b-91ae-364da2661108)
https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes(af854a3a-2127-422b-91ae-364da2661108)
https://www.reprisesoftware.com/RELEASE_NOTES(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.