CVE-2024-1149

HIGH

Snow Inventory Agent <= 6.7.2, <= 6.12.0, <= 6.14.5 - File Manipulation via Snow Update Packages

Title source: llm
STIX 2.1

Description

Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.

References (1)

Core 1

Scores

CVSS v3 7.8
EPSS 0.0012
EPSS Percentile 2.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-347
Status published
Products (2)
snowsoftware/snow_inventory_agent 6.12.0
snowsoftware/snow_inventory_agent < 6.7.2
Published Feb 08, 2024
Tracked Since Feb 18, 2026