CVE-2023-3937

Published: Aug 11, 2023Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser

Affected (1)

Products: Snowsoftware: Snow License Manager

Snowsoftware

1 product

Snow License Manager

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Snowsoftware Snow License Manager	From 9.0.0 to 9.30.1

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC

Source: security@snowsoftware.com

Issue TrackingVendor Advisory

https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.