GCVE-110-CLOUD-2023-0059

Advisory Published

Vulnetix · Advisory published January 17, 2023

Through an undocumented API service called 'iamadmin', attackers could invoke any of 13 read-only IAM actions without the activity being being logged to CloudTrail. These actions included listing group policies (iam:ListGroupPolicies), listing access keys (iam:ListAccessKeys), retrieving information about a role (iam:GetRole), and more. This could have enabled adversaries to perform enumeration and reconnaissance activity undetected after gaining a foothold in a victim AWS environment.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
AWS	Cloud Services	—	—
AWS	IAM	—	—
AWS	CloudTrail	—	—

References

AWS CloudTrail bypass for specific IAM actions

advisory

Browse GCVE Records

73,834 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON