CVE-2025-14503

Katalog CVE

CVSS 7.2 · High EPSS 0,52%

Kerentanan Incorrect Privilege Assignment pada amazon harmonix. Skor CVSS 3.1 7.2 (High) menurut CNA.

Deskripsi (NVD)

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM principal in the same AWS account with sts:AssumeRole permissions to assume the role with administrative privileges. We recommend customers upgrade to Harmonix on AWS v0.4.2 or later if you have deployed the framework using versions v0.3.0 through v0.4.1.

Rincian

Terbit di NVD

15 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/AWS-2025-031/ patch · advisory vendor
• https://github.com/awslabs/harmonix/security/advisories/GHSA-qm86-gqrq-mqcw advisory vendor
• https://github.com/awslabs/harmonix/pull/189 issue tracking