Lucene search

SnowCVELIST:CVE-2023-3864

HistoryAug 11, 2023 - 11:24 a.m.

CVE-2023-3864 SQL injection vulnerability in Snow License Manager

2023-08-1111:24:05

CWE-89

Snow

www.cve.org

cve-2023-3864

snow license manager

sql injection

windows

web portal

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with high privileges to inject SQL commands via the web portal.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "x86",
      "64 bit",
      "32 bit"
    ],
    "product": "SLM",
    "vendor": "Snow Software",
    "versions": [
      {
        "lessThanOrEqual": "9.30.1",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "0"
      }
    ]
  }
]

References

community.snowsoftware.com/s/feed/0D56M00009gUexuSAC

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Related for CVELIST:CVE-2023-3864