VDB
CVE-2025-2598
CVE-2025-2598
PUBLISHED
CVSS 5.5 MEDIUM
When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
EPSS 0.07% · 21.9th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.07%
21.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| npm | cdk | 2.172.0 |
| amazon | aws_cloud_development_kit | 2.172.0 |
| npm | aws-cdk | 2.172.0 |
| AWS | Cloud Development Kit Command Line Interface | 2.172.0 |
Exploit Intelligence
- In theory, we exploit cve-2025-2598. Hope it works (github-poc)
- In theory, we exploit cve-2025-2598. Hope it works (github-poc)
- In theory, we exploit cve-2025-2598. Hope it works (github-poc)
- In theory, we exploit cve-2025-2598. Hope it works (github-poc)
- In theory, we exploit cve-2025-2598. Hope it works (github-poc)
- In theory, we exploit cve-2025-2598. Hope it works (github-poc)
- In theory, we exploit cve-2025-2598. Hope it works (github-poc)
- Testing if AWS exploit CVE-2025-2598 still works (github-poc)
- Testing if AWS exploit CVE-2025-2598 still works (github-poc)
- Testing if AWS exploit CVE-2025-2598 still works (github-poc)
…and 9 more exploits
Timeline
- Mar 21, 2025 CVE Published
- Mar 21, 2025 Coalition ESS Score
- Mar 21, 2025 PoC Published
- Mar 22, 2025 EPSS Score
- Apr 4, 2025 EPSS Score
- Apr 17, 2025 EPSS Score
- May 1, 2025 EPSS Score
- May 14, 2025 EPSS Score
- May 27, 2025 EPSS Score
- Jun 9, 2025 EPSS Score
- Jun 23, 2025 EPSS Score
- Jul 6, 2025 EPSS Score
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-005/ vendor-advisory
- https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp third-party-advisory
- https://github.com/aws/aws-cdk/releases/tag/v2.178.2 patch
- https://nvd.nist.gov/vuln/detail/CVE-2025-2598 advisory
- https://aws.amazon.com/security/security-bulletins/AWS-2025-005 url
- https://github.com/aws/aws-cdk package