Auth bypass in Amazon Aws_cloud_development_kit
CVE-2023-35165
AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks…
Vulnerability class: Broken Access Control
EPSS: 0.009 (55.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Amazon Aws_cloud_development_kit
- Aws Aws-cdk — versions aws-cdk-lib >= 2.0.0, < 2.80.0, @aws-cdk/aws-eks >= 1.57.0, < 1.202.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory, Mitigation)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Mitigation, Issue Tracking)
Frequently asked questions
- What is CVE-2023-35165?
- CVE-2023-35165 is a medium-severity vulnerability in Amazon Aws_cloud_development_kit, classified under Incorrect Authorization. CVSS score: 6.6/10. Published 2023-06-23.
- How severe is CVE-2023-35165?
- Medium severity. CVSS v3 base score is 6.6 out of 10.