cve-2021-44151
Vulnerability from cvelistv5
Published
2021-12-13 00:00
Modified
2024-08-04 04:17
Severity ?
Summary
An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g., /goforms/menu) and saving the name of the cookie sent with the response. The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit.
References
cve@mitre.orghttp://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.htmlThird Party Advisory, VDB Entry
cve@mitre.orghttps://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yesProduct, Vendor Advisory
cve@mitre.orghttps://www.reprisesoftware.com/RELEASE_NOTES
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yesProduct, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.reprisesoftware.com/RELEASE_NOTES
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:17:23.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://reprisesoftware.com/admin/rlm-admin-download.php?\u0026euagree=yes"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.reprisesoftware.com/RELEASE_NOTES"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g., /goforms/menu) and saving the name of the cookie sent with the response. The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-20T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://reprisesoftware.com/admin/rlm-admin-download.php?\u0026euagree=yes"
        },
        {
          "url": "http://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.html"
        },
        {
          "url": "https://www.reprisesoftware.com/RELEASE_NOTES"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-44151",
    "datePublished": "2021-12-13T00:00:00",
    "dateReserved": "2021-11-22T00:00:00",
    "dateUpdated": "2024-08-04T04:17:23.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-44151\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2021-12-13T04:15:07.137\",\"lastModified\":\"2024-11-21T06:30:27.020\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g., /goforms/menu) and saving the name of the cookie sent with the response. The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado un problema en Reprise RLM versi\u00f3n 14.2. Como las cookies de sesi\u00f3n son peque\u00f1as, un atacante puede secuestrar cualquier sesi\u00f3n presente forzando la cookie de sesi\u00f3n de 4 caracteres hexadecimales en la versi\u00f3n de Windows (la versi\u00f3n de Linux parece tener 8 caracteres). Un atacante puede obtener la parte est\u00e1tica de la cookie (nombre de la cookie) al hacer primero una petici\u00f3n a cualquier p\u00e1gina de la aplicaci\u00f3n (por ejemplo, /goforms/men\u00fa) y guardando el nombre de la cookie enviada con la respuesta. El atacante puede entonces usar el nombre de la cookie e intentar solicitar esa misma p\u00e1gina, estableciendo un valor aleatorio para la cookie. Si alg\u00fan usuario presenta una sesi\u00f3n activa, la p\u00e1gina deber\u00eda volver con el contenido autorizado, cuando se encuentre un valor de cookie v\u00e1lido\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-330\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:reprisesoftware:reprise_license_manager:14.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7398E968-24AF-4006-92A0-B9DDC49EF43D\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://reprisesoftware.com/admin/rlm-admin-download.php?\u0026euagree=yes\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\",\"Vendor Advisory\"]},{\"url\":\"https://www.reprisesoftware.com/RELEASE_NOTES\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://packetstormsecurity.com/files/165191/Reprise-License-Manager-14.2-Session-Hijacking.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://reprisesoftware.com/admin/rlm-admin-download.php?\u0026euagree=yes\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\",\"Vendor Advisory\"]},{\"url\":\"https://www.reprisesoftware.com/RELEASE_NOTES\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.