CVE-2025-2598

Katalog CVE

CVSS 5.5 · Medium EPSS 0,27%

Kerentanan Exposure of Sensitive System Information to an Unauthorized Control Sphere pada amazon aws cloud development kit. Skor CVSS 3.1 5.5 (Medium) menurut CNA.

Deskripsi (NVD)

When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

Rincian

Terbit di NVD

21 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/AWS-2025-005/ advisory vendor
• https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp advisory vendor
• https://github.com/aws/aws-cdk/releases/tag/v2.178.2