CVE-2022-28365 - Vulnerability Details - OpenCVE

Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture, and file/directory details.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Reprisesoftware	Reprise License Manager

Configuration 1 [-]

cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html
https://seclists.org/fulldisclosure/2022/Apr/1
https://www.reprisesoftware.com/RELEASE_NOTES
https://www.reprisesoftware.com/products/software-license-management.php

History

Wed, 30 Apr 2025 21:30:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:reprisesoftware:reprise_license_manager:14.2:::::::*	cpe:2.3:a:reprisesoftware:reprise_license_manager::::::::

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-04-09T00:00:00

Updated: 2024-08-03T05:56:14.870Z

Reserved: 2022-04-03T00:00:00

Link: CVE-2022-28365

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-04-09T17:15:08.013

Modified: 2025-04-30T21:00:47.660

Link: CVE-2022-28365

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "7BAA96A8-FE33-49EB-9385-CE80D62BE8A7", "versionEndExcluding": "15.1", "versionStartIncluding": "14.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture, and file/directory details."}, {"lang": "es", "value": "Reprise License Manager versi\u00f3n 14.2, est\u00e1 afectado por una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n por medio de una petici\u00f3n GET a /goforms/rlminfo. No es requerida autenticaci\u00f3n. La informaci\u00f3n divulgada est\u00e1 asociada a versiones de software, IDs de procesos, configuraci\u00f3n de red, nombre(s) de host, arquitectura del sistema y detalles de archivos/directorios"}], "id": "CVE-2022-28365", "lastModified": "2025-04-30T21:00:47.660", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-09T17:15:08.013", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2022/Apr/1"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://www.reprisesoftware.com/RELEASE_NOTES"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.reprisesoftware.com/products/software-license-management.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2022/Apr/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://www.reprisesoftware.com/RELEASE_NOTES"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.reprisesoftware.com/products/software-license-management.php"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-425"}], "source": "nvd@nist.gov", "type": "Primary"}]}