LiveActive security incident?Get immediate response
CVE Record

CVE-2021-45422: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/a...

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-45422 is a reflected cross-site scripting issue in Reprise License Manager 14.2. An unauthenticated web request can place attacker-controlled content into a response. Business risk is mainly user-session abuse or phishing through a trusted license-management interface, especially if the RLM web UI is reachable beyond administrators.

Executive priority

Treat as a targeted web-interface risk, not a confirmed mass-exploitation emergency. Prioritize any internet-exposed or broadly reachable RLM 14.2 instances, then remediate through vendor guidance and access restriction.

Technical view

The CVE describes unauthenticated reflected XSS in Reprise License Manager 14.2, affecting the GET count parameter of /goform/activate_process. The source bundle provides no CVSS score, no named CWE, and no vendor patch details. Public references include disclosure and PoC material, but not confirmed active exploitation.

Likely exposure

Exposure is most likely where RLM 14.2 web administration endpoints are reachable from user networks, VPNs, or the internet. The bundle does not prove other versions are affected.

Exploitation context

CISA KEV status is false in the bundle. Public PoC-style references exist, so testing knowledge is public, but the supplied sources do not establish active exploitation in the wild.

Researcher notes

The affected product/version evidence is narrow: Reprise License Manager 14.2 only. The bundle lacks CVSS, CWE, CPEs, and patch metadata. Avoid broad version claims unless confirmed by vendor advisories or additional primary sources.

Mitigation direction

  • Check Reprise vendor guidance for fixed or supported versions.
  • Upgrade or patch RLM if vendor guidance identifies a corrected release.
  • Restrict the RLM web interface to trusted administrative networks.
  • Block internet exposure to RLM management endpoints where possible.
  • Monitor requests to /goform/activate_process for unusual count parameter activity.

Validation and detection

  • Inventory systems running Reprise License Manager and confirm exact versions.
  • Identify whether RLM 14.2 web interfaces are reachable without authentication.
  • Review access logs for requests to /goform/activate_process using count.
  • Confirm network controls limit access to authorized administrators.
  • Document any exposed instances and prioritize vendor-guided remediation.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-45422 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.