CVE-2023-3937

MediumCVSS 4.8

Published: 11/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

CVE-2023-3937 describes a cross site scripting vulnerability in the web portal of Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows. It allows an authenticated user with high privileges to trigger an XSS attack via the web browser.

Risk Assessment

The risk to the organization involves the potential for XSS attacks, which can lead to data theft or session hijacking. The high privileges of the attacker increase the potential impact of the attack.

Recommendation

It is recommended to update Snow Software License Manager to the latest version to mitigate this vulnerability. Additionally, implementing extra security measures such as input validation is advisable.

Original NVD description (English source)

Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser