GitHub Advisoryadvisory · PyPI

GHSA-4fpg-j5mp-783g Cloudtoken Insufficiently Protects Credentials

LOW Published 2022-05-13 Modified 2024-09-13 Official page ↗
Aliases
CVE-2018-13390
Ecosystem
PyPI
Packages
cloudtoken
Severity
Low
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-522
Reviewed
2024-04-22

Affected packages

• PyPI cloudtoken: >= 0.1.1, < 0.1.24 → fixed in 0.1.24

Description

Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles.

Related

Alias · CVE (1)

  • CVE-2018-13390 Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References