CVE-2024-1149

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1149
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK Vendor Advisory
https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:49

Type Values Removed Values Added
References () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory
CVSS v2 : unknown
v3 : 5.5 		v2 : unknown
v3 : 7.8

15 Feb 2024, 17:52

Type Values Removed Values Added
CPE cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
First Time Apple
Linux linux Kernel
Apple macos
Linux
Microsoft
Microsoft windows

15 Feb 2024, 17:30

Type Values Removed Values Added
Summary
  • (es) Verificación incorrecta de la vulnerabilidad de firma criptográfica en Snow Software Inventory Agent en MacOS, Snow Software Inventory Agent en Windows y Snow Software Inventory Agent en Linux permite la manipulación de archivos a través de paquetes de actualización Snow. Este problema afecta a Inventory Agent: hasta 6.12.0; Agente de Inventario: hasta 6.14.5; Agente de Inventario: hasta 6.7.2.
References () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 5.5
First Time Snowsoftware snow Inventory Agent
Snowsoftware
CPE cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*

08 Feb 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-08 13:15

Updated : 2024-11-21 08:49

NVD link : CVE-2024-1149

Mitre link : CVE-2024-1149

CVE.ORG link : CVE-2024-1149

JSON object : View

Products Affected

snowsoftware

  • snow_inventory_agent

linux

  • linux_kernel

microsoft

  • windows

apple

  • macos
CWE
CWE-347

Improper Verification of Cryptographic Signature