CVE-2023-44031 is a high severity (CVSS 7.5) incorrect access control flaw in Reprise License Manager v15.1. A crafted POST request lets an attacker save sensitive files in insecure locations. The record names no fixed version, so check Reprise's advisories and restrict access to the manager.
What's affected
The record names Reprise License Manager v15.1. It lists no fixed version and no version range, and the Packet Storm and Full Disclosure references it points to describe the issue as a privilege escalation through file write. We could not read those pages (Packet Storm showed a bot check page) so this article relies on the record's description.
The record scores the issue 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. That is network reachable, no privileges, no user interaction, with the impact on integrity only. The weakness is CWE-284, improper access control. The record does not mark the CVE as known exploited.
Because we could not confirm fixed versions, do not treat any other release as safe or unsafe on our word. Ask Reprise which version addresses CVE-2023-44031.
How to check if you're exposed
Reprise License Manager (RLM) is a license server used by software vendors and their customers, often running on a shared server.
- Find RLM servers in your environment. The service is usually called rlm, and the web administration interface listens on its own port.
- Check the version in the RLM web interface status page or in the command line output of the license server.
- Note who can reach the RLM web port from your network.
- Check the folder permissions for the RLM install and its working directory, since the issue is about files saved in insecure locations.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Restrict access to the RLM web administration port to administrators only.
- Run the license manager under a low privilege account with write access only to the folders it needs.
- Contact Reprise and ask which release fixes CVE-2023-44031. Update to it when confirmed.
- Monitor the RLM install folder and the system for unexpected new or changed files.
- Keep a record of the version you run so you can match it against future advisories.
Why it matters
Access control flaws let a user do something the software should have refused. Here, the record says a crafted request lets the caller choose where sensitive files are written. Writing a file into an unsafe location can overwrite configuration or place content where another program will use it.
The CVSS impact is on integrity and not on confidentiality or availability, so the main fear is tampering. License servers are often forgotten infrastructure that run for years with default settings, which is why a quick inventory and a network restriction go a long way.
Quick check
What does the flaw let an attacker do?
According to the record, save sensitive files in insecure locations through a crafted POST request.
Is there a patched version?
The record does not name one. Ask Reprise or check its release notes.
Sources
- Full Disclosure post (record reference, not readable when fetched)
- Packet Storm file (record reference, not readable when fetched)
Last reviewed: 19 October 2026.
