How severe is CVE-2025-24791?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 4.4 out of 10.

What type of vulnerability is CVE-2025-24791?

This is classified as CWE-281, which is a common weakness in software security.

CVE-2025-24791 - MEDIUM Severity | CVSS 4.4

Vulnerability Description

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.

Related Vulnerabilities

CVE-2021-38553

MEDIUM

CVSS:4.4(Medium)

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in ...

CWE-2812021

CVE-2017-5033

MEDIUM

CVSS:4.3(Medium)

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote atta...

CWE-2812017

CVE-2019-14956

MEDIUM

CVSS:4.3(Medium)

JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.

CWE-2812019

CVE-2020-13230

MEDIUM

CVSS:4.3(Medium)

In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).

CWE-2812020

CVE-2021-23963

MEDIUM

CVSS:4.3(Medium)

When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This ...

CWE-2812021

CVE-2022-2787

MEDIUM

CVSS:4.3(Medium)

Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.

CWE-2812022