9.8

CVE-2020-28472: amazon aws_sdk_for_javascipt

CVSS: 9.8v3.1CriticalModified
AliasesGHSA-rrc9-gqf8-8rwg
Published 19-01-2021Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2020-28472 is a critical (CVSS 9.8) vulnerability in amazon aws_sdk_for_javascipt. EPSS estimates a 2.17% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
2.17%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits4reference

Timeline

  1. 19-01-2021
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

2.17%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

+0.03 pp

From 2.14% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found
  • referenceUnverified

    Exploit Reference (snyk.io)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (snyk.io)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (snyk.io)

    Maturity: unknown

Show all 4 exploits
  • referenceUnverified

    Exploit Reference (snyk.io)

    Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Amazon2 products
  • aws_sdk_for_javascipt< 2.814.0
  • aws_shared_configuration_file_loader1.0.0:alpha1 | 1.0.0:alpha2 | 1.0.0:alpha3 | 1.0.0:beta1 | 1.0.0:beta2 | 1.0.0:beta3 | 1.0.0:beta4 | 1.0.0:gamma1 | 1.0.0:gamma2 | 1.0.0:gamma3 | 1.0.0:gamma4 | 1.0.0:gamma5 | 1.0.0:gamma6 | 1.0.0:gamma7 | 1.0.0:gamma8 | 1.0.0:rc1 | 1.0.0:rc2 | 1.0.0:rc3 | 1.0.0:rc8
@aws-sdk1 product
  • shared-ini-file-loader< 1.0.0-rc.9
Npm1 product
  • aws-sdk< 2.814.0

3 vendors · 4 products

References

7 links