// For flags

CVE-2023-51386

Sandbox Accounts for Events vulnerable to privilege escalation to read running events data

Severity Score

3.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.

Sandbox Accounts for Events proporciona múltiples cuentas temporales de AWS a varios usuarios autenticados simultáneamente a través de una GUI basada en navegador. Los usuarios autenticados podrían leer datos de la tabla de eventos enviando payloads de solicitudes a la API de eventos, recopilando información sobre eventos planificados, plazos, presupuestos y direcciones de correo electrónico de los propietarios. Este acceso a los datos puede permitir a los usuarios obtener información sobre los próximos eventos y unirse a eventos a los que no han sido invitados. Este problema se solucionó en la versión 1.10.0.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-18 CVE Reserved
  • 2023-12-22 CVE Published
  • 2023-12-23 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Amazon
Search vendor "Amazon"
 Awslabs Sandbox Accounts For Events
Search vendor "Amazon" for product "Awslabs Sandbox Accounts For Events"
 < 1.1.0
Search vendor "Amazon" for product "Awslabs Sandbox Accounts For Events" and version " < 1.1.0"
-
Affected