CVE-2024-45037

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates. We identified an issue in AWS Cloud Development Kit (CDK) which, under certain conditions, can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application uses the "RestApi" construct with "CognitoUserPoolAuthorizer" as the authorizer and uses authorization scopes to limit access. This issue does not affect the availability of the specific API resources. Authenticated Cognito users may gain unintended access to protected API resources or methods, leading to potential data disclosure, and modification issues. Impacted versions: >=2.142.0;<=2.148.0. A patch is included in CDK versions >=2.148.1. Users are advised to upgrade their AWS CDK version to 2.148.1 or newer and re-deploy their application(s) to address this issue.

• CWE-863

• https://docs.aws.amazon.com/cdk/v2/guide/home.htmlProduct
• https://github.com/aws/aws-cdk/commit/4bee768f07e73ab5fe466f9ad3d1845456a0513bPatch
• https://github.com/aws/aws-cdk/releases/tag/v2.148.1Release Notes
• https://github.com/aws/aws-cdk/security/advisories/GHSA-qj85-69xf-2vxqVendor Advisory

Published

Aug 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45030In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-45031When editing objects in the Syncope Console, incomplete HTML…6.1
• CVE-2024-45032A vulnerability has been identified in Industrial Edge Manag…10
• CVE-2024-45033Insufficient Session Expiration vulnerability in Apache Airf…8.1
• CVE-2024-45034Apache Airflow versions before 2.10.1 have a vulnerability t…8.8
• CVE-2024-45036Tophat is a mobile applications testing harness. An Improper…4.3
• CVE-2024-45038Meshtastic device firmware is a firmware for meshtastic devi…7.5
• CVE-2024-45039gnark is a fast zk-SNARK library that offers a high-level AP…6.2
• CVE-2024-4504A vulnerability, which was classified as critical, has been …7.2
• CVE-2024-45040gnark is a fast zk-SNARK library that offers a high-level AP…5.9
• CVE-2024-45041External Secrets Operator is a Kubernetes operator that inte…8.8
• CVE-2024-45042Ory Kratos is an identity, user management and authenticatio…4.4