CVE-2024-28056
1 advisory.
npm/@aws-amplify/cli CVE-2024-28056: critical 9.8
AWS Amplify CLI has incorrect trust policy management
Action: Upgrade @aws-amplify/cli to 12.10.1 or later.
npm i @aws-amplify/cli@12.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 12.10.1 | - |
Fixed versions
| 12.10.1 |
Sources
- osv: GHSA-846g-p7hm-f54r
- https://nvd.nist.gov/vuln/detail/CVE-2024-28056
- https://github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d4a1
- https://aws.amazon.com/security/security-bulletins/AWS-2024-003
- https://github.com/aws-amplify/amplify-cli
- https://github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fac/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json
- https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1
- https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover
CVE-2024-28056 · published · modified · JSON