Detections
Analytics

SCA: security update for @aws-amplify/cli (GHSA-846g-p7hm-f54r)

critical Tenable Cloud Security Plugin ID 412409

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated
 with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition
 property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity
 would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the
 Authentication component from a project built between August 2019 and January 2024, an "assume role" may
 have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS
 resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication
 component. (The vulnerability did not give a threat actor the ability to remove an Authentication
 component.) However, in realistic situations, an authorized AWS user may have removed an Authentication
 component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely
 different identity provider. (CVE-2024-28056)

See Also

https://github.com/advisories/GHSA-846g-p7hm-f54r

Plugin Details

Severity: Critical

ID: 412409

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.86

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-28056

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/15/2024

Vulnerability Publication Date: 4/15/2024

Reference Information

CVE: CVE-2024-28056