{"action":"Upgrade @aws-amplify/cli to 12.10.1 or later.","affected":[{"fixed":"12.10.1","introduced":"0"}],"component":"@aws-amplify/cli","cve_ids":["CVE-2024-28056"],"ecosystem":"npm","epss":0.01665,"exploited":false,"fixed_versions":["12.10.1"],"ghsa_id":"GHSA-846g-p7hm-f54r","id":"tcs_01M5KFBN3KTC8SEA8EQ59BBKKX","modified_at":"2024-08-15T21:38:29Z","published_at":"2024-04-15T18:30:51Z","references":["https://osv.dev/vulnerability/GHSA-846g-p7hm-f54r","https://nvd.nist.gov/vuln/detail/CVE-2024-28056","https://github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d4a1","https://aws.amazon.com/security/security-bulletins/AWS-2024-003","https://github.com/aws-amplify/amplify-cli","https://github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fac/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json","https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1","https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-846g-p7hm-f54r","url":"https://osv.dev/vulnerability/GHSA-846g-p7hm-f54r"}],"summary":"AWS Amplify CLI has incorrect trust policy management"}