VDB
CVE-2025-2598
CVE-2025-2598
PUBLISHED
CVSS 5.5 MEDIUM
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
EPSS 0.26% · 17.7th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.26%
17.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| npm | cdk | 2.172.0 |
| amazon | aws_cloud_development_kit | 2.172.0 |
| npm | aws-cdk | 2.172.0 |
| AWS | Cloud Development Kit Command Line Interface | 2.172.0 |
Timeline
- Mar 21, 2025 CVE Published
- Mar 21, 2025 Coalition ESS Score
- Mar 21, 2025 PoC Published
- Mar 22, 2025 EPSS Score
- Apr 4, 2025 EPSS Score
- Apr 18, 2025 EPSS Score
- May 1, 2025 EPSS Score
- May 14, 2025 EPSS Score
- May 27, 2025 EPSS Score
- Jun 10, 2025 EPSS Score
- Jun 23, 2025 EPSS Score
- Jul 6, 2025 EPSS Score
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-005/ vendor-advisory
- https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp third-party-advisory
- https://github.com/aws/aws-cdk/releases/tag/v2.178.2 patch
- https://nvd.nist.gov/vuln/detail/CVE-2025-2598 advisory
- https://aws.amazon.com/security/security-bulletins/AWS-2025-005 url
- https://github.com/aws/aws-cdk package