-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/aws/amazon-cloudwatch-agent | go | < 1.247355.0 | 1.247355.0 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from how the Windows installer (MSI) handled privilege elevation during repairs. The commit diff shows the vulnerable version used a direct PowerShell execution command (UpdateConfigPermission) with 'Impersonate="no"', granting SYSTEM privileges but displaying a visible window. The patched version replaces this with WixQuietExec and proper PowerShell path resolution to prevent UI interaction. This specific CustomAction implementation in the installer configuration was the root cause of the privilege escalation vector.
Ongoing coverage of React2Shell