title: Improper validation of update packages
description: Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.
problem types: CWE-347 Improper Verification of Cryptographic Signature
affected:
{
defaultStatus: unaffected
platforms: MacOS
product: Inventory Agent
vendor: Snow Software
versions:
lessThanOrEqual: 6.12.0, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
platforms: Windows
product: Inventory Agent
vendor: Snow Software
versions:
lessThanOrEqual: 6.14.5, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
platforms: Linux
product: Inventory Agent
vendor: Snow Software
versions:
lessThanOrEqual: 6.7.2, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL