« Volver al listado

CVE-2025-24793

Estado: AnalizadaAlta (7)—

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-89 SQL injection en módulo local (AV:L, PR:L) permite escalada de privilegios y lectura de datos sensibles. Acceso local con privilegios y sin interacción del usuario sugiere T1068; impactos incluyen extracción de datos (T1005) y manipulación de BD (T1565.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageExecution PreventionEncrypt Sensitive InformationApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Snowflake — Snowflake Connector

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24793",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24793",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-31T16:53:59.700519Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "snowflakedb",
          "product": "snowflake-connector-python",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.2.5, < 3.13.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-29T21:15:21.270",
  "references": [
    {
      "url": "https://github.com/snowflakedb/snowflake-connector-python/commit/f3f9b666518d29c31a49384bbaa9a65889e72056",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-2vpq-fh52-j3wv",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1."
    },
    {
      "lang": "es",
      "value": "Snowflake Connector para Python proporciona una interfaz para desarrollar aplicaciones Python que se pueden conectar a Snowflake y realizar todas las operaciones estándar. Snowflake descubrió y solucionó una vulnerabilidad en el conector Snowflake para Python. Una función del módulo snowflake.connector.pandas_tools es vulnerable a la inyección SQL. Esta vulnerabilidad afecta a las versiones 2.2.5 a 3.13.0. Snowflake solucionó el problema en la versión 3.13.1."
    }
  ],
  "lastModified": "2026-06-17T08:59:37.193",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:snowflake:snowflake_connector:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50A24C7A-37B8-471D-A198-22A39C06C820",
              "versionEndExcluding": "3.13.1",
              "versionStartIncluding": "2.2.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}