Summary

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.

Affected Products

The vulnerability affects the FlexNet Publisher lmadmin version 11.19.11 and earlier.

Remediation

Administrator authentication is now properly enforced for all administrative operations, ensuring that only authenticated and authorized users can access privileged administrative functionality.

Fix

Revenera has fixed this vulnerability in FlexNet Publisher lmadmin 11.19.11.1. Customers using affected versions are encouraged to upgrade to lmadmin 11.19.11.1 to obtain the security fix. The latest lmadmin version can be downloaded from the FlexNet Publisher lmadmin Download Links article.

Additional Information

Credited: For identifying this issue and disclosing it to Revenera PSIRT under the responsible disclosure process, we'd like to credit Ryan Wincey (@rwincey) of Securifera.