Veracode Vulnerability DatabaseVERACODE:40847Command Injection
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.007 Low
EPSS
Percentile
79.9%
snowflake_connector_python is vulnerable to Command Injection. The vulnerability is due to an improper URL filter, which allows an attacker to create a rouge SSO server which when a user connects to results in code injection.
| CPE | Name | Operator | Version |
|---|---|---|---|
| snowflake-connector-python | le | 3.0.1 | |
| snowflake-connector-python | le | 3.0.1 |
References
community.snowflake.com/s/article/Snowflake-Connector-for-Python-Release-Notes
github.com/snowflakedb/snowflake-connector-python/commit/1cdbd3b1403c5ef520d7f4d9614fe35165e101ac
github.com/snowflakedb/snowflake-connector-python/pull/1480
github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-5w5m-pfw9-c8fp
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.007 Low
EPSS
Percentile
79.9%