CVE-2024-4129 - Vulnerability Details - OpenCVE

Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/virtual-ciso
https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA

History

No history.

MITRE

Status: PUBLISHED

Assigner: Snow

Published: 2024-05-10T06:55:53.209Z

Updated: 2024-08-01T20:33:52.889Z

Reserved: 2024-04-24T13:00:51.438Z

Link: CVE-2024-4129

Vulnrichment

Updated: 2024-08-01T20:33:52.889Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T15:42:57.983

Modified: 2024-11-21T09:42:14.810

Link: CVE-2024-4129

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4129", "assignerOrgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "state": "PUBLISHED", "assignerShortName": "Snow", "dateReserved": "2024-04-24T13:00:51.438Z", "datePublished": "2024-05-10T06:55:53.209Z", "dateUpdated": "2024-08-01T20:33:52.889Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Snow License Manager", "vendor": "Snow Software AB", "versions": [{"lessThanOrEqual": "9.34.0", "status": "affected", "version": "9.33.2", "versionType": "custom"}]}], "datePublic": "2024-05-10T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.<p>This issue affects Snow License Manager: from 9.33.2 through 9.34.0.</p>"}], "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.\n\n"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "shortName": "Snow", "dateUpdated": "2024-05-10T06:57:33.669Z"}, "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to version 9.34.1 or apply a hotfix for your specific version."}], "value": "Update to version 9.34.1 or apply a hotfix for your specific version."}], "source": {"discovery": "UNKNOWN"}, "title": "Authentication bypass in Snow License Manager", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-10T18:19:26.323440Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:snowsoftware:snow_license_manager:*:*:*:*:*:*:*:*"], "vendor": "snowsoftware", "product": "snow_license_manager", "versions": [{"status": "affected", "version": "9.33.2", "versionType": "custom", "lessThanOrEqual": "9.34.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:56:26.866Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.889Z"}, "title": "CVE Program Container", "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.889Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-10T18:19:26.323440Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:snowsoftware:snow_license_manager:*:*:*:*:*:*:*:*"], "vendor": "snowsoftware", "product": "snow_license_manager", "versions": [{"status": "affected", "version": "9.33.2", "versionType": "custom", "lessThanOrEqual": "9.34.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-10T18:21:22.321Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Authentication bypass in Snow License Manager", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Snow Software AB", "product": "Snow License Manager", "versions": [{"status": "affected", "version": "9.33.2", "versionType": "custom", "lessThanOrEqual": "9.34.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to version 9.34.1 or apply a hotfix for your specific version.", "supportingMedia": [{"type": "text/html", "value": "Update to version 9.34.1 or apply a hotfix for your specific version.", "base64": false}]}], "datePublic": "2024-05-10T07:00:00.000Z", "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.\n\n", "supportingMedia": [{"type": "text/html", "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.<p>This issue affects Snow License Manager: from 9.33.2 through 9.34.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "shortName": "Snow", "dateUpdated": "2024-05-10T06:57:33.669Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4129", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:33:52.889Z", "dateReserved": "2024-04-24T13:00:51.438Z", "assignerOrgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "datePublished": "2024-05-10T06:55:53.209Z", "assignerShortName": "Snow"}, "dataVersion": "5.1"}