CVE-2021-44152

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 58.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-13 · updated 2026-06-17
Weakness: CWE-306

Description

An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.

Affected products

Reprisesoftware Reprise License Manager: before 15.1 — fixed in 15.1

How to fix

Upgrade to a fixed version: Reprisesoftware Reprise License Manager 15.1. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html
https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes
https://www.reprisesoftware.com/RELEASE_NOTES
http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html
https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes
https://www.reprisesoftware.com/RELEASE_NOTES

Get alerted when CVE-2021-44152 or the next vulnerability affects your stack