CVE-2024-1149

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1149
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK Vendor Advisory
https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:49

Type Values Removed Values Added
References () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory
CVSS v2 : unknown
v3 : 5.5 		v2 : unknown
v3 : 7.8

15 Feb 2024, 17:52

Type Values Removed Values Added
First Time Microsoft windows
Microsoft
Linux
Apple macos
Linux linux Kernel
Apple
CPE cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

15 Feb 2024, 17:30

Type Values Removed Values Added
CPE cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 5.5
References () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory
Summary
  • (es) Verificación incorrecta de la vulnerabilidad de firma criptográfica en Snow Software Inventory Agent en MacOS, Snow Software Inventory Agent en Windows y Snow Software Inventory Agent en Linux permite la manipulación de archivos a través de paquetes de actualización Snow. Este problema afecta a Inventory Agent: hasta 6.12.0; Agente de Inventario: hasta 6.14.5; Agente de Inventario: hasta 6.7.2.
First Time Snowsoftware
Snowsoftware snow Inventory Agent

08 Feb 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-08 13:15

Updated : 2024-11-21 08:49

NVD link : CVE-2024-1149

Mitre link : CVE-2024-1149

CVE.ORG link : CVE-2024-1149

JSON object : View

Products Affected

linux

  • linux_kernel

snowsoftware

  • snow_inventory_agent

apple

  • macos

microsoft

  • windows
CWE
CWE-347

Improper Verification of Cryptographic Signature