PT-2025-12422 · Aws · Aws Cdk Cli

Iliapolo · Published 2025-03-21 · Updated 2025-12-17 · CVE-2025-2598

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AWS CDK CLI versions prior to 2.178.2

Description The issue arises when the AWS CDK CLI is used with a credential plugin that returns an expiration property with the retrieved AWS credentials, causing the credentials to be printed to the console output.

Recommendations For versions prior to 2.178.2, upgrade to version 2.178.2 or later to resolve the issue. Additionally, ensure any forked or derivative code is patched to incorporate the new fixes.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-2598

GHSA-V63M-X9R9-8GQP

Affected Products

Aws Cdk Cli

References · 12

• https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp · Vendor Advisory
• https://github.com/aws/aws-cdk/releases/tag/v2.178.2 · Patch
• https://aws.amazon.com/security/security-bulletins/AWS-2025-005 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v63m-x9r9-8gqp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2598 · Security Note
• https://github.com/aws/aws-cdk · Note
• https://twitter.com/alex_pulver/status/1903142036825575835 · Twitter Post
• https://t.me/cvedetector/20818 · Telegram Post
• https://twitter.com/CVEnew/status/1903157997972390185 · Twitter Post
• https://twitter.com/TheExploitLab/status/2001279593714733082 · Twitter Post
• https://t.me/cvetracker/19623 · Telegram Post