CVE-2021-44155

MEDIUM

Reprise License Manager 14.2-<15.1 - User Enumeration via Login Error Message

Title source: llm
STIX 2.1

Description

An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.

References (3)

Core 3

Scores

CVSS v3 5.3
EPSS 0.0185
EPSS Percentile 76.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-209
Status published
Products (1)
reprisesoftware/reprise_license_manager 14.2 - 15.1
Published Dec 13, 2021
Tracked Since Feb 18, 2026