Description (CNA)
An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Amazon / WorkSpaces Client | affected 5.0.0 before 5.21.0 |
| Amazon / WorkSpaces Client | affected 2023.0 before 2024.2 |
| Amazon / AppStream 2.0 Client | affected 1.1.1025 before 1.1.1332 |
| Amazon / DCV Client | affected 0 before 2023.1.6703 |
| Amazon / DCV Client | affected 2020.2.7459 before 2023.1.9127 |
| Amazon / WorkSpaces Client | affected 5.5.0 before 5.21.0 |
| Amazon / DCV Client | affected 2020.2.2078 before 2023.1.6703 |
CWE
CWE-295
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-001/
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes
- https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.html
- https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388jul
ADP enrichment
No English description supplied.
No references supplied.