PT-2025-9698 · Aws · Team

Werner Bester · Published 2025-03-04 · Updated 2025-03-21 · CVE-2025-1969

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center versions prior to 1.2.2

Description The issue is related to improper request input validation, allowing a user to modify a valid request and spoof an approval.

Recommendations Upgrade to the latest release v.1.2.2 and follow the instructions in the updating TEAM documentation for the updating process.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

CWE-807

Related Identifiers

CVE-2025-1969

GHSA-X9XV-R58P-QH86

Affected Products

Team

References · 10

• https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.2.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-1969 · Security Note
• https://aws.amazon.com/security/security-bulletins/AWS-2025-004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1969 · Vendor Advisory
• https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-x9xv-r58p-qh86 · Note
• https://twitter.com/CVEnew/status/1897133268207640751 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1897131810389139954 · Twitter Post
• https://twitter.com/eyalestrin/status/1897652666517569751 · Twitter Post
• https://t.me/cvedetector/19540 · Telegram Post
• https://twitter.com/kthrtty/status/1902894176406253875 · Twitter Post