CVE-2018-19981: amazon aws_software_development_kit
Vulnerability summary
CVE-2018-19981 is a high (CVSS 9.0) vulnerability in amazon aws_software_development_kit. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78% of scored vulnerabilities. 4 public exploits are recorded.
Timeline
- 04-04-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege access to the Android filesystem in order to exploit this vulnerability (i.e. the device has been compromised, such as disabling or bypassing Android's fundamental security mechanisms).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.80%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.80% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (raw.githubusercontent.com)
Maturity: unknown
Exploit Reference (raw.githubusercontent.com)
Maturity: unknown
Exploit Reference (raw.githubusercontent.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Amazon1 product
- aws_software_development_kit≤ 2.8.5
1 vendor · 1 product
References
4 links- raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_01.pngX Refsource MISCExploitThird Party Advisory
- raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_02.pngX Refsource MISCExploitThird Party Advisory
- raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_03.pngX Refsource MISCExploitThird Party Advisory