9
CVE-2023-50928
- EPSS 0.06%
- Veröffentlicht 22.12.2023 21:15:08
- Zuletzt bearbeitet 21.11.2024 08:37:32
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Loginsandbox-accounts-for-events security misconfiguration leads to budget exceed
"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Amazon ≫ Awslabs Sandbox Accounts For Events Version < 1.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.194 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9 | 2.3 | 6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
|
| security-advisories@github.com | 7.1 | 2.8 | 3.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.