CVE-2022-28363

Deeper analysis

Reprise License Manager version 14.2 contains a reflected cross-site scripting vulnerability (CWE-79) in the username parameter of the /goform/login_process endpoint when accessed via an unauthenticated GET request. The flaw allows attacker-controlled script to execute in the context of a victim's browser session with the affected license management application.

An unauthenticated remote attacker can exploit the issue by supplying a crafted URL containing malicious JavaScript in the username field. Successful exploitation can result in theft of session data or other limited confidentiality and integrity impacts within the victim's browser, consistent with the CVSS 6.1 rating that notes network attack vector, low complexity, and required user interaction.

Public references including Packet Storm and Full Disclosure postings describe the flaw and provide proof-of-concept details, but no vendor advisory or patch information is supplied in the available references. The associated EPSS score has remained flat at 0.1389 with no material increase after disclosure.