CVE-2021-44152

Katalog CVE

CVSS 9.8 · Critical EPSS 58,6%

Kerentanan Missing Authentication for Critical Function pada reprisesoftware reprise license manager. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.

Rincian

Terbit di NVD

13 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

58,6% peluang dieksploitasi; lebih tinggi dari 99,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes patch · product · advisory vendor
• https://www.reprisesoftware.com/RELEASE_NOTES advisory vendor
• http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html exploit · advisory pihak ketiga · vdb entry