Privilege escalation in Amazon Awslabs Sandbox Accounts For Events
CVE-2023-51386
Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.
Vulnerability class: Privilege Escalation
EPSS: 0.002 (6.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-51386?
- CVE-2023-51386 is a high-severity vulnerability in Amazon Awslabs Sandbox Accounts For Events, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2023-12-22.
- How severe is CVE-2023-51386?
- High severity. CVSS v3 base score is 7.8 out of 10.