-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the CloudFormation custom resource handler in update-idp-roles-cfn.json that manages IAM role trust policies. When handling authentication component removal (Delete event), the code deleted Condition blocks but failed to set Effect to Deny, leaving Allow statements without security constraints. The commit diff explicitly shows the vulnerable code path where Condition deletion wasn't accompanied by Effect modification until the patch added the Deny assignments. This matches the vulnerability description of creating overly permissive sts:AssumeRoleWithWebIdentity policies when removing authentication.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @aws-amplify/cli | npm | < 12.10.1 | 12.10.1 |
A Semantic Attack on Google Gemini - Read the Latest Research