Detections
Analytics

SCA: security update for snowflake-connector-python (GHSA-5w5m-pfw9-c8fp)

high Tenable Cloud Security Plugin ID 411047

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The Snowflake Connector for Python provides an interface for developing Python applications that can
 connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to
 command injection via single sign-on(SSO) browser URL authentication. In order to exploit the potential
 for command injection, an attacker would need to be successful in (1) establishing a malicious resource
 and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly
 accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a
 user into visiting the maliciously crafted connection URL, the user’s local machine would render the
 malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL
 whitelisting as well as common anti-phishing resources. Version 3.0.2 contains a patch for this issue.
 (CVE-2023-34233)

See Also

https://github.com/advisories/GHSA-5w5m-pfw9-c8fp

Plugin Details

Severity: High

ID: 411047

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-34233

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/9/2023

Vulnerability Publication Date: 6/8/2023

Reference Information

CVE: CVE-2023-34233

cwe: CWE-77