CVE-2025-3717

LowCVSS 2.1/10Last modified Oct 18, 2026

Description

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it  could result in 

the wrong user identifier being used, and information for which the viewer is not authorized being returned. 

This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.

Metrics

CVSS 4.0 2.1/10CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-653

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-371707.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371717.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371727.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating sCVE-2025-371737.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 CVE-2025-371747.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 oCVE-2025-371757.2Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operaCVE-2025-371767.2A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potenCVE-2025-371776.5An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or ACVE-2025-371787.5Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insuCVE-2025-371795.3Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insuCVE-2025-37185.4A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input paCVE-2025-371817.2Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to per
CVE-2025-3717: Low severity, CVSS 2.1 | Vulnix