{"id":"CVE-2024-1149","state":"PUBLISHED","title":"Improper validation of update packages","description":"Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.\n\n","publishedAt":"2024-02-08T13:01:03.806Z","updatedAt":"2025-05-15T19:40:41.899Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Snow"},"assigner":"Snow","products":["Snow Software Inventory Agent"],"affected":[{"vendor":"Snow Software","product":"Inventory Agent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.12.0","versionType":"custom"}],"platforms":["MacOS"]},{"vendor":"Snow Software","product":"Inventory Agent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.14.5","versionType":"custom"}],"platforms":["Windows"]},{"vendor":"Snow Software","product":"Inventory Agent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.7.2","versionType":"custom"}],"platforms":["Linux"]}],"references":["https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK"],"weaknesses":["CWE-347"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1149.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1149","state":"PUBLISHED","datePublished":"2024-02-08T13:01:03.806Z","dateUpdated":"2025-05-15T19:40:41.899Z","assignerShortName":"Snow","assignerOrgId":"ea911274-ddd9-4e68-b39a-d7d6ae8b8a65","dateReserved":"2024-02-01T09:47:48.899Z"},"containers":{"cna":{"title":"Improper validation of update packages","descriptions":[{"lang":"en","value":"Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.\n\n"}],"affected":[{"vendor":"Snow Software","product":"Inventory Agent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.12.0","versionType":"custom"}],"platforms":["MacOS"]},{"vendor":"Snow Software","product":"Inventory Agent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.14.5","versionType":"custom"}],"platforms":["Windows"]},{"vendor":"Snow Software","product":"Inventory Agent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.7.2","versionType":"custom"}],"platforms":["Linux"]}],"references":[{"url":"https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"CWE-347 Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Snow","orgId":"ea911274-ddd9-4e68-b39a-d7d6ae8b8a65","dateUpdated":"2024-02-08T13:01:03.806Z"},"datePublic":"2024-02-08T12:00:00.000Z","impacts":[{"capecId":"CAPEC-165","descriptions":[{"lang":"en","value":"CAPEC-165 File Manipulation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:26:30.511Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-08T15:45:43.042291Z","id":"CVE-2024-1149","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-15T19:40:41.899Z"}}]}}}