Executive brief
Snowstorm is a medical terminology and knowledge management system used for managing and distributing SNOMED clinical coding standards. A reflected cross-site scripting (XSS) vulnerability in its Web Route redirection feature allows attackers to inject malicious JavaScript that executes when users click a crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of the victim.
Technical details
The vulnerability is a reflected XSS flaw in the WebRouteController component responsible for handling Web Route redirects. The application fails to properly sanitize or escape user-supplied input in redirect parameters before reflecting it back in HTTP responses. An attacker can craft a malicious URL containing JavaScript code which executes in the victim's browser when the link is visited, without requiring authentication or user interaction beyond clicking the link. The vulnerability is fixed in versions 10.12.2 and 10.9.3, with patches addressing the issue by ensuring error responses are properly contained within JSON/XML response blocks.
Affected products
- SNOMED International Snowstorm before 10.9.3 and 10.12.2
Timeline
- 2026-08-04: disclosed
- 2026: patched: Fixed in versions 10.12.2 and 10.9.3