CVE-2021-45422
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the victim's browser, leading to session theft, redirection to malicious sites, or data theft.
Recommendation
Immediately update Reprise License Manager to a version after 14.2 or apply a security patch. If updating is not possible, restrict access to the admin panel and sanitize input parameters.
Other vulnerabilities in Reprise License Manager
See all- CVE-2021-37500High
A directory traversal vulnerability in the Reprise License Manager (RLM) web interface before version 14.2BL4 in the diagnostics function allows RLM users with sufficient privileges to overwrite any file on the server.
- CVE-2021-37499Medium
CRLF vulnerability in the Reprise License Manager (RLM) web interface through version 14.2BL4 in the password parameter of the View License Result function allows remote attackers to inject arbitrary HTTP headers.
- CVE-2021-37498Medium
An SSRF vulnerability was discovered in the Reprise License Manager (RLM) web interface up to version 14.2BL4. It allows remote attackers to send requests to internal servers and perform port scans via the actserver parameter in the License Activation function.
Original NVD description (English source)
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS