CVE-2018-19981 - CVE House
Back to Database
Status published High CVE-2018-19981

Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to...

Vulnerability Description

Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege access to the Android filesystem in order to exploit this vulnerability (i.e. the device has been compromised, such as disabling or bypassing Android's fundamental security mechanisms).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19981

Credits & Attribution

No credits recorded in the NVD database.

References

More from amazon

View All →
CVE-2024-52314
data.all admin user may access potentially sensitive data stored by producers via logs
Medium 6.9
CVE-2024-52313
data.all authenticated users can obtain incorrect object level authorizations
Medium 5.3
CVE-2024-52312
data.all authenticated users can perform restricted operations against DataSets and Environments
Medium 5.3
CVE-2024-52311
data.all does not invalidate authentication token upon user logout
Medium 5.3
CVE-2024-10953
data.all authenticated users can perform mutating update operations on persisted notification records
Medium 5.3

Affected Vendor

Affected Software

aws software development kit
Vulnerable Versions:
0

Timeline

Official Publish: April 4th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.