CVE-2024-1149

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1149
Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

15 Feb 2024, 17:52

Type Values Removed Values Added
First Time Linux linux Kernel
Apple
Snowsoftware
Linux
Microsoft
Snowsoftware snow Inventory Agent
Apple macos
Microsoft windows
Summary
  • (es) Verificación incorrecta de la vulnerabilidad de firma criptográfica en Snow Software Inventory Agent en MacOS, Snow Software Inventory Agent en Windows y Snow Software Inventory Agent en Linux permite la manipulación de archivos a través de paquetes de actualización Snow. Este problema afecta a Inventory Agent: hasta 6.12.0; Agente de Inventario: hasta 6.14.5; Agente de Inventario: hasta 6.7.2.
References () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - () https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK - Vendor Advisory
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:6.12.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:a:snowsoftware:snow_inventory_agent:*:*:*:*:*:*:*:*

08 Feb 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-08 13:15

Updated : 2024-02-15 17:52

NVD link : CVE-2024-1149

Mitre link : CVE-2024-1149

CVE.ORG link : CVE-2024-1149

JSON object : View

Products Affected

snowsoftware

  • snow_inventory_agent

microsoft

  • windows

apple

  • macos

linux

  • linux_kernel
CWE
CWE-347

Improper Verification of Cryptographic Signature