CVE-2023-43183 is a high severity (CVSS 8.8) incorrect access control flaw in Reprise License Manager 15.1. A read-only user can change the password of an administrator and take over that account. The record names no fixed version, so ask the vendor and restrict access to the web interface until you have one.
What's affected
The record lists one product, Reprise License Management Software, Reprise License Manager, and one version, 15.1. Its description says read-only users can arbitrarily change the password of an admin and hijack their account.
The record gives no fixed version and no CWE. Its references are a Full Disclosure mailing list post from January 2024 and a Packet Storm entry whose title describes a privilege escalation and file write in version 15.1. When I fetched them, the mailing list page was empty and the Packet Storm page returned only a verification screen, so I could not confirm the vendor's response or a fixed release.
That is why this page does not name a patched version. Contact the vendor or read its release notes. If your installation runs a later release than 15.1, the record is not evidence that it is vulnerable, but confirm it with the vendor.
How to check if you're exposed
Find the version of Reprise License Manager on your license server. The web interface usually shows the version on its status page. Check the process and the network exposure of the web port:
ps aux | grep -i rlm
ss -tlnp | grep -i rlm
Look at who holds accounts on the manager. The flaw needs a read-only login, so the number of those accounts, and where they can connect from, defines your exposure. Check the access log for password change requests you did not expect.
What to do now
- Identify every Reprise License Manager instance and its version.
- Ask Reprise for the fixed release and its release notes, and plan the upgrade.
- Restrict the web interface to administrator networks and remove it from public exposure.
- Remove unused read-only accounts and rotate the administrator passwords.
- Review the access logs for unexpected password changes.
- Keep the license server on a segment that engineering users can reach only on the ports they need.
Why it matters
This is a classic access control gap: the application checks who you are but not what you may do on the account change function. A read-only user should not be able to set another user's password, yet the record says they can for an administrator. The result is full account takeover of the highest role.
The vector in the record is network based and needs a low privilege account, with high impact on confidentiality, integrity and availability. License servers are often treated as background plumbing and left on flat networks, which makes any read-only login more valuable than it should be. The KEV flag is false. The record has no weakness class, so none is linked.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
The record does not name one and I could not read the references, so I cannot confirm. Ask the vendor directly.
Sources
- Full Disclosure post, January 2024 (referenced in the record; content did not load when fetched)
- Packet Storm file 176841 (referenced in the record; content did not load when fetched)
Last reviewed: 19 October 2026.
