Vulnerability · Published Jan 29, 2025 · Assigned by GitHub_M
CVE-2025-24788Snowflake Connector for .NET has weak temporary files permissions
Medium 5.0
In plain English
A medium-severity incorrect default permissions in snowflake-connector-net from snowflakedb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions 2.0.12 through 4.2.0 on Linux and macOS. Snowflake fixed the issue in version 4.3.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | snowflake.data | 4.3.0 | GHSA-2mqw-rq5m-8hc8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| snowflakedb | snowflake-connector-net | >= 2.0.12, < 4.3.0 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N