CVE-2018-15574

Name of the Vulnerable Software and Affected Versions Reprise License Manager (RLM) versions through 12.2BL2

Description The issue is related to a cross-site scripting vulnerability in the license editor. It affects the "/goform/edit lf get data" endpoint, specifically the lf parameter, which can be exploited via GET or POST requests. The vendor has stated that they do not consider this a vulnerability.

Recommendations For Reprise License Manager (RLM) versions through 12.2BL2, as a temporary workaround, consider restricting access to the "/goform/edit lf get data" endpoint to minimize the risk of exploitation. Avoid using the lf parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.