CVE-2021-41562 Deletion of arbitrary files vulnerability in Snow Agent for Windows

Medium 6.1 Published 3 Nov 2021 Updated 16 Sep 2024

A non-admin user can delete arbitrary files on the system via the Snow Agent for Windows application.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-41562?

CVE-2021-41562 is a medium-severity path traversal vulnerability in Snow Agent for Windows, published on 3 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows.

Weakness: CWE-64

Which versions are affected by CVE-2021-41562?

It affects 1 product.

Products include Snowsoftware Snow Inventory Agent.

How do I fix CVE-2021-41562?

No fix has been published for CVE-2021-41562 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-41562 being exploited?

There is no known exploitation of CVE-2021-41562 in the wild and no public exploit code.

Sources

Also known as GHSA-p28f-73x9-f7vr.