2 lines
4.2 KiB
JSON
2 lines
4.2 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AWS API MCP Server","vendor":"AWS","versions":[{"lessThan":"1.3.9","status":"affected","version":"0.2.14","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:amazon:aws_api_mcp_server:*:*:*:*:*:python:*:*","matchCriteriaId":"EE415FFE-9C17-4E1A-8608-7DAA348BDAA6","versionEndExcluding":"1.3.9","versionStartIncluding":"0.2.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context.\n\nTo remediate this issue, users should upgrade to version 1.3.9."},{"lang":"es","value":"Protección Inadecuada de Ruta Alternativa existe en la característica no-access y workdir del servidor AWS API MCP versiones >= 0.2.14 y < 1.3.9 en todas las plataformas, lo que puede permitir la omisión de la restricción de acceso a archivos prevista y exponer contenidos de archivos locales arbitrarios en el contexto de la aplicación cliente MCP.\n\nPara remediar este problema, los usuarios deben actualizar a la versión 1.3.9."}],"id":"CVE-2026-4270","lastModified":"2026-06-17T10:56:20.093","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-16T18:17:07.044936Z","version":"2.0.3"}}]},"published":"2026-03-16T17:16:32.270","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","tags":["Vendor Advisory"],"url":"https://aws.amazon.com/security/security-bulletins/2026-007-AWS/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","tags":["Third Party Advisory"],"url":"https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.9/"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]}
|