CVE-2018-5716

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-02-21 · updated 2026-06-17
Weakness: CWE-22

Description

An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter "lf" to the goform/edit_lf_get_data URI, the attacker can retrieve the content of a file.

Affected products

Reprisesoftware Reprise License Manager: from 11.0 before 16.1 — fixed in 16.1

How to fix

Upgrade to a fixed version: Reprisesoftware Reprise License Manager 16.1. Check the vendor advisory for mitigations.

References

http://www.0x90.zone/web/path-traversal/2018/02/16/Path-Traversal-Reprise-LM.html
http://www.0x90.zone/web/path-traversal/2018/02/16/Path-Traversal-Reprise-LM.html

Get alerted when CVE-2018-5716 or the next vulnerability affects your stack