CVE-2018-15869

awscli: Allows loading of an undesired AMI by setting similar image properties

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.0

Review impact separately from score.

Published · August 14, 2018

Updated · November 22, 2025

Description

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-20 · Improper Input Validation