CVE-2025-24791CWE-281

snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions

Medium · published January 29, 2025

CVSS v3.1
4.4
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-281 · Improper Preservation of Permissions
Published
2025-01-29T16:59Z
EPSS history
Timeline
  • 29 JAN 16:59Z
    snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissions
    cvelistv5