Vulnerability Description
"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Awslabs Sandbox Accounts For Events | < 1.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734ebPatch
- https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-Third Party Advisory
- https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734ebPatch
- https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-Third Party Advisory
FAQ
What is CVE-2023-50928?
CVE-2023-50928 is a vulnerability with a CVSS score of 7.1 (HIGH). "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and acces...
How severe is CVE-2023-50928?
CVE-2023-50928 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-50928?
Check the references section above for vendor advisories and patch information. Affected products include: Amazon Awslabs Sandbox Accounts For Events.