{"id":"CVE-2023-3937","state":"PUBLISHED","title":"Cross site scripting vulnerabilities in Snow License Manager","description":"Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser","publishedAt":"2023-08-11T11:28:30.185Z","updatedAt":"2024-10-03T20:27:22.370Z","severity":{"score":4.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","source":"Snow"},"assigner":"Snow","products":["Snow Software Snow License Manager"],"affected":[{"vendor":"Snow Software","product":"Snow License Manager","defaultStatus":"unaffected","versions":[{"version":"9.0.0","status":"affected","lessThanOrEqual":"9.30.1","versionType":"0"}],"platforms":["Windows","x86","64 bit","32 bit"]}],"references":["https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/3xxx/CVE-2023-3937.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-3937","state":"PUBLISHED","datePublished":"2023-08-11T11:28:30.185Z","dateUpdated":"2024-10-03T20:27:22.370Z","assignerShortName":"Snow","assignerOrgId":"ea911274-ddd9-4e68-b39a-d7d6ae8b8a65","dateReserved":"2023-07-25T13:29:16.203Z"},"containers":{"cna":{"title":"Cross site scripting vulnerabilities in Snow License Manager","descriptions":[{"lang":"en","value":"Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser"}],"affected":[{"vendor":"Snow Software","product":"Snow License Manager","defaultStatus":"unaffected","versions":[{"version":"9.0.0","status":"affected","lessThanOrEqual":"9.30.1","versionType":"0"}],"platforms":["Windows","x86","64 bit","32 bit"]}],"references":[{"url":"https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Snow","orgId":"ea911274-ddd9-4e68-b39a-d7d6ae8b8a65","dateUpdated":"2023-08-11T13:53:50.811Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Can Doğu & Himanshu Giri"}],"datePublic":"2023-08-11T01:00:00.000Z","impacts":[{"capecId":"CAPEC-63","descriptions":[{"lang":"en","value":"CAPEC-63 Cross-Site Scripting (XSS)"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to SLM version 9.30.2"}],"value":"Upgrade to SLM version 9.30.2"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:08:50.686Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-03T20:27:08.462859Z","id":"CVE-2023-3937","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-03T20:27:22.370Z"}}]}}}