PT-2025-9698 · Aws · Team

Werner Bester · Publicado 2025-03-04 · Atualizado 2025-03-21 · CVE-2025-1969

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center versions prior to 1.2.2

Description The issue is related to improper request input validation, allowing a user to modify a valid request and spoof an approval.

Recommendations Upgrade to the latest release v.1.2.2 and follow the instructions in the updating TEAM documentation for the updating process.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

CWE-807

Identificadores relacionados

CVE-2025-1969

GHSA-X9XV-R58P-QH86

Produtos afetados

Team

Referências · 10

• https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.2.2 · Correção
• https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-x9xv-r58p-qh86 · Nota
• https://twitter.com/CVEnew/status/1897133268207640751 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-1969 · Nota de Segurança
• https://aws.amazon.com/security/security-bulletins/AWS-2025-004 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1897131810389139954 · Publicação no Twitter
• https://twitter.com/eyalestrin/status/1897652666517569751 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-1969 · Aviso do Fabricante
• https://t.me/cvedetector/19540 · Publicação no Telegram
• https://twitter.com/kthrtty/status/1902894176406253875 · Publicação no Twitter