title: Cross site scripting vulnerabilities in Snow License Manager
description: Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
platforms: [Windows, x86, 64 bit, 32 bit]
product: Snow License Manager
vendor: Snow Software
versions:
lessThanOrEqual: 9.30.1, status: affected, version: 9.0.0, versionType: 0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade to SLM version 9.30.2