CVE-2025-24788

MEDIUM

Snowflake Connector for .NET 2.0.12-4.2.0 - Unauthorized Local File Access via World-Readable Temporary Directory

Title source: llm
STIX 2.1

Description

snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions 2.0.12 through 4.2.0 on Linux and macOS. Snowflake fixed the issue in version 4.3.0.

References (2)

Core 2

Scores

CVSS v3 5.0
EPSS 0.0014
EPSS Percentile 3.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-276
Status published
Products (2)
nuget/Snowflake.Data 2.0.12 - 4.3.0NuGet
snowflake/snowflake_connector 2.0.12 - 4.3.0
Published Jan 29, 2025
Tracked Since Feb 18, 2026