CVE-2023-50928

"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.

• CWE-284

• https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79Patch
• https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32rThird Party Advisory
• https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79Patch
• https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32rThird Party Advisory

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50921An issue was discovered on GL.iNet devices through 4.5.0. At…9.8
• CVE-2023-50922An issue was discovered on GL.iNet devices through 4.5.0. At…7.2
• CVE-2023-50923In QUIC in RFC 9000, the Latency Spin Bit specification (sec…4.3
• CVE-2023-50924Englesystem is a shift planning system for chaos events. Eng…5.4
• CVE-2023-50926Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2023-50927Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2023-5093Rejected reason: This CVE id was assigned to an issue which …
• CVE-2023-50930An issue was discovered in savignano S/Notify before 4.0.2 f…7.1
• CVE-2023-50931An issue was discovered in savignano S/Notify before 2.0.1 f…5.4
• CVE-2023-50932An issue was discovered in savignano S/Notify before 4.0.2 f…5.4
• CVE-2023-50933IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injectio…6.1
• CVE-2023-50934IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authenticat…5.3