CVE-2024-1149

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1149
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK Vendor Advisory
https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:49

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.5 		v2 : unknown
v3 : 7.8
References () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory

15 Feb 2024, 17:52

Type Values Removed Values Added
First Time Apple
Linux linux Kernel
Apple macos
Linux
Microsoft
Microsoft windows
CPE cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

15 Feb 2024, 17:30

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 5.5
Summary
  • (es) Verificación incorrecta de la vulnerabilidad de firma criptográfica en Snow Software Inventory Agent en MacOS, Snow Software Inventory Agent en Windows y Snow Software Inventory Agent en Linux permite la manipulación de archivos a través de paquetes de actualización Snow. Este problema afecta a Inventory Agent: hasta 6.12.0; Agente de Inventario: hasta 6.14.5; Agente de Inventario: hasta 6.7.2.
CPE cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
First Time Snowsoftware snow Inventory Agent
Snowsoftware
References () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory

08 Feb 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-08 13:15

Updated : 2024-11-21 08:49

NVD link : CVE-2024-1149

Mitre link : CVE-2024-1149

CVE.ORG link : CVE-2024-1149

JSON object : View

Products Affected

apple

  • macos

microsoft

  • windows

linux

  • linux_kernel

snowsoftware

  • snow_inventory_agent
CWE
CWE-347

Improper Verification of Cryptographic Signature