CVE-2018-15573 File upload in n/a

High 8.8 Published 20 Aug 2018 Updated 5 Aug 2024

Attackers can read and write arbitrary files via the unauthenticated web interface, potentially compromising the system.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-15573?

CVE-2018-15573 is a high-severity vulnerability in n/a, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Reprise License Manager (RLM) through 12.2BL2. Attackers can use the web interface to read and write data to any file on disk (as long as rlm.exe has access to it) via /goform/edit_lf_process with file content in the lfdata parameter and a pathname in the lf parameter. By default, the web interface is on port 5054, and does not require authentication. NOTE: the vendor has stated "We do not consider this a vulnerability.

Weakness: CWE-434

Which versions are affected by CVE-2018-15573?

It affects 1 product.

Products include Reprisesoftware Reprise License Manager.

How do I fix CVE-2018-15573?

No fix has been published for CVE-2018-15573 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-15573 being exploited?

There is no known exploitation of CVE-2018-15573 in the wild and no public exploit code.

Sources

Also known as GHSA-93xq-g83c-52rf.