CVE-2024-4129 - Vulnerability Details - OpenCVE

Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00109.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-32689	Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.

Fixes

Solution

Update to version 9.34.1 or apply a hotfix for your specific version.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Snow

Published: 2024-05-10T06:55:53.209Z

Updated: 2024-08-01T20:33:52.889Z

Reserved: 2024-04-24T13:00:51.438Z

Link: CVE-2024-4129

Vulnrichment

Updated: 2024-08-01T20:33:52.889Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T15:42:57.983

Modified: 2024-11-21T09:42:14.810

Link: CVE-2024-4129

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-287

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4129", "assignerOrgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "state": "PUBLISHED", "assignerShortName": "Snow", "dateReserved": "2024-04-24T13:00:51.438Z", "datePublished": "2024-05-10T06:55:53.209Z", "dateUpdated": "2024-08-01T20:33:52.889Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Snow License Manager", "vendor": "Snow Software AB", "versions": [{"lessThanOrEqual": "9.34.0", "status": "affected", "version": "9.33.2", "versionType": "custom"}]}], "datePublic": "2024-05-10T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.<p>This issue affects Snow License Manager: from 9.33.2 through 9.34.0.</p>"}], "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.\n\n"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "shortName": "Snow", "dateUpdated": "2024-05-10T06:57:33.669Z"}, "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to version 9.34.1 or apply a hotfix for your specific version."}], "value": "Update to version 9.34.1 or apply a hotfix for your specific version."}], "source": {"discovery": "UNKNOWN"}, "title": "Authentication bypass in Snow License Manager", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-10T18:19:26.323440Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:snowsoftware:snow_license_manager:*:*:*:*:*:*:*:*"], "vendor": "snowsoftware", "product": "snow_license_manager", "versions": [{"status": "affected", "version": "9.33.2", "versionType": "custom", "lessThanOrEqual": "9.34.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:56:26.866Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.889Z"}, "title": "CVE Program Container", "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.889Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-10T18:19:26.323440Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:snowsoftware:snow_license_manager:*:*:*:*:*:*:*:*"], "vendor": "snowsoftware", "product": "snow_license_manager", "versions": [{"status": "affected", "version": "9.33.2", "versionType": "custom", "lessThanOrEqual": "9.34.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-10T18:21:22.321Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Authentication bypass in Snow License Manager", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Snow Software AB", "product": "Snow License Manager", "versions": [{"status": "affected", "version": "9.33.2", "versionType": "custom", "lessThanOrEqual": "9.34.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to version 9.34.1 or apply a hotfix for your specific version.", "supportingMedia": [{"type": "text/html", "value": "Update to version 9.34.1 or apply a hotfix for your specific version.", "base64": false}]}], "datePublic": "2024-05-10T07:00:00.000Z", "references": [{"url": "https://community.snowsoftware.com/s/feed/0D5Td000008dv8sKAA"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through 9.34.0.\n\n", "supportingMedia": [{"type": "text/html", "value": "Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.<p>This issue affects Snow License Manager: from 9.33.2 through 9.34.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "shortName": "Snow", "dateUpdated": "2024-05-10T06:57:33.669Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4129", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:33:52.889Z", "dateReserved": "2024-04-24T13:00:51.438Z", "assignerOrgId": "ea911274-ddd9-4e68-b39a-d7d6ae8b8a65", "datePublished": "2024-05-10T06:55:53.209Z", "assignerShortName": "Snow"}, "dataVersion": "5.1"}