CVE-2021-37499

CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function, that allows remote attackers to inject arbitrary HTTP headers.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
reprisesoftwarereprise_license_manager
𝑥
< 17.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://reprise.com
http://reprisesoftware.com
https://github.com/blakduk/Advisories/blob/main/Reprise%20License%20Manager/README.md
http://reprise.com
http://reprisesoftware.com
https://github.com/blakduk/Advisories/blob/main/Reprise%20License%20Manager/README.md