CVE-2023-3864

HighCVSS 7.2

Published: 11/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

36th percentile - higher than 36% of all known CVEs

Summary

A blind SQL injection vulnerability exists in Snow Software license manager versions from 8.0.0 to 9.30.1 on Windows. A logged-in user with high privileges can inject SQL commands via the web portal.

Risk Assessment

This vulnerability could lead to unauthorized access to data and potential system takeover by an attacker. The high privileges of the user increase the risk of severe consequences.

Recommendation

It is recommended to update Snow Software license manager to the latest version to mitigate this vulnerability. Access to the web portal should also be restricted to trusted users.

Other vulnerabilities in Snow Software license manager

CVE-2023-3937Medium
CVE-2023-3937 describes a cross site scripting vulnerability in the web portal of Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows. It allows an authenticated user with high privileges to trigger an XSS attack via the web browser.

Original NVD description (English source)

Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with high privileges to inject SQL commands via the web portal.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS