CVE-2022-25165 - CVE House
Back to Database
Status published High CVE-2022-25165

An issue was discovered in Amazon AWS VPN Client 2.0.0....

Vulnerability Description

An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log, which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25165

Credits & Attribution

No credits recorded in the NVD database.

References

More from amazon

View All →
CVE-2024-52314
data.all admin user may access potentially sensitive data stored by producers via logs
Medium 6.9
CVE-2024-52313
data.all authenticated users can obtain incorrect object level authorizations
Medium 5.3
CVE-2024-52312
data.all authenticated users can perform restricted operations against DataSets and Environments
Medium 5.3
CVE-2024-52311
data.all does not invalidate authentication token upon user logout
Medium 5.3
CVE-2024-10953
data.all authenticated users can perform mutating update operations on persisted notification records
Medium 5.3

Affected Vendor

Affected Software

aws client vpn
Vulnerable Versions:
2.0.0

Timeline

Official Publish: April 14th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.