cbcvebase.
CVE-2022-28363
published 2022-04-09

CVE-2022-28363: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No…

PriorityP182medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
4.27%
89.8th percentile
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required.

Affected

1 ranges
VendorProductVersion rangeFixed in
reprisesoftwarereprise_license_manager>= 14.2 < 16.016.0

Detection & IOCsextracted from sources · hover to see the quote

url/goform/login_process?username=test%22%3E%3Csvg/onload=alert(document.domain)%3E↗
path/goform/login_process↗
  • →Look for GET requests to /goform/login_process with XSS payloads (e.g., SVG/onload) in the 'username' parameter — no authentication required to trigger. ↗
  • →HTTP response body will contain the reflected payload string alongside 'Login Failed' text with a 200 status code and text/html content-type. ↗
  • →Identify exposed Reprise License Manager instances via Shodan using html keyword matches. ↗
  • →Identify exposed Reprise License Manager instances via FOFA using body keyword matches. ↗
  • →Identify exposed Reprise License Manager instances via Google dork targeting the /goforms/menu path. ↗
  • ·Vulnerability affects specifically Reprise License Manager version 14.2; other versions may or may not be affected. ↗

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.