CVE-2018-19981

Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have "root" privilege access to the Android filesystem in order to exploit this vulnerability (i.e. the device has been compromised, such as disabling or bypassing Android's fundamental security mechanisms).

• CWE-312

• https://aws-amplify.github.io/aws-sdk-android/docs/reference/com/amazonaws/auth/CognitoCachingCredentialsProvider.htmlExploit, Third Party Advisory
• https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_01.pngExploit, Third Party Advisory
• https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_02.pngExploit, Third Party Advisory
• https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_03.pngExploit, Third Party Advisory
• https://aws-amplify.github.io/aws-sdk-android/docs/reference/com/amazonaws/auth/CognitoCachingCredentialsProvider.htmlExploit, Third Party Advisory
• https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_01.pngExploit, Third Party Advisory
• https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_02.pngExploit, Third Party Advisory
• https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_03.pngExploit, Third Party Advisory

Published

Apr 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19975In YARA 3.8.1, bytecode in a specially crafted compiled rule…
• CVE-2018-19976In YARA 3.8.1, bytecode in a specially crafted compiled rule…
• CVE-2018-19977A command injection (missing input validation, escaping) in …
• CVE-2018-19978A buffer overflow vulnerability in the DHCP and PPPOE config…
• CVE-2018-1998IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local u…8.8
• CVE-2018-19980Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attack…
• CVE-2018-19982An issue was discovered on KT MC01507L Z-Wave S0 devices. It…
• CVE-2018-19983An issue was discovered on Sigma Design Z-Wave S0 through S2…
• CVE-2018-19985The function hso_get_config_data in drivers/net/usb/hso.c in…
• CVE-2018-19986In the /HNAP1/SetRouterSettings message, the RemotePort para…
• CVE-2018-19987D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-86…
• CVE-2018-19988In the /HNAP1/SetClientInfoDemo message, the AudioMute and A…