« Volver al listado

CVE-2025-24792

Estado: AplazadaMedia (4.4)—

Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Snowflake — PHP PDO DriverAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24792",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24792",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-29T15:41:02.352960Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "snowflakedb",
          "product": "pdo_snowflake",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.2.0, < 3.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-29T16:15:44.273",
  "references": [
    {
      "url": "https://github.com/snowflakedb/pdo_snowflake/security/advisories/GHSA-f8q2-7fv5-cg93",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-195"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0."
    },
    {
      "lang": "es",
      "value": "Snowflake PHP PDO Driver es un controlador que utiliza la extensión PHP Data Objects (PDO) para conectarse a la base de datos Snowflake. Snowflake descubrió y solucionó una vulnerabilidad en el controlador PHP PDO de Snowflake, en la que la ejecución de consultas no admitidas como PUT o GET en las etapas provoca un error de conversión de firma a no firma que bloquea la aplicación que utiliza el controlador. Esta vulnerabilidad afecta a las versiones 0.2.0 a 3.0.3. Snowflake solucionó el problema en la versión 3.1.0."
    }
  ],
  "lastModified": "2026-06-17T08:59:37.087",
  "sourceIdentifier": "security-advisories@github.com"
}