GitHub Advisoryadvisory · Go

GHSA-pp3f-98qg-5g75 aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9

HIGH Published 2022-07-13 Modified 2022-07-21 Official page ↗
Aliases
CVE-2022-2385
Ecosystem
Go
Packages
sigs.k8s.io/aws-iam-authenticator
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-07-15

Affected packages

• Go sigs.k8s.io/aws-iam-authenticator: < 0.5.9 → fixed in 0.5.9

Description

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Related

Alias · CVE (1)

  • CVE-2022-2385 A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References