Description
Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with high privileges to inject SQL commands via the web portal.
References (1)
Core 1
Core References
Issue Tracking, Vendor Advisory
https://community.snowsoftware.com/s/feed/0D56M00009gUexuSAC
Scores
CVSS v3
7.2
EPSS
0.0046
EPSS Percentile
36.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
snowsoftware/snow_license_manager
8.0.0 - 9.30.1
Published
Aug 11, 2023
Tracked Since
Feb 18, 2026