Log in Start free

Vulnerability · Published Jan 15, 2025 · Assigned by AMZN

CVE-2025-0500Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients

High 7.5

In plain English

A high-severity improper certificate validation in AppStream 2.0 Client from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 56.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.

Affected products (as reported)

VendorProductVersions
Amazon WorkSpaces Client 5.0.0 – before 5.21.0
Amazon WorkSpaces Client 2023.0 – before 2024.2
Amazon AppStream 2.0 Client 1.1.1025 – before 1.1.1332
Amazon DCV Client 0 – before 2023.1.6703
Amazon DCV Client 2020.2.7459 – before 2023.1.9127
Amazon WorkSpaces Client 5.5.0 – before 5.21.0
Amazon DCV Client 2020.2.2078 – before 2023.1.6703

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References