Aws Toolkit Vscode
Monthly
World-readable CodeCatalyst token cache files in AWS Toolkit for VS Code versions before 4.10.0 let any other local user on the same host recover bearer tokens for a victim who has connected the CodeCatalyst integration. The flaw is a local information-disclosure and privilege-escalation concern (CWE-276, CVSS 6.8) rather than a remote attack: it requires a shared multi-user system, an ordinary local login, no user interaction, and no elevated privileges, and yields only read impact (confidentiality) with no integrity or availability loss. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the vendor has released a fix in version 4.10.0.
World-readable CodeCatalyst token cache files in AWS Toolkit for VS Code versions before 4.10.0 let any other local user on the same host recover bearer tokens for a victim who has connected the CodeCatalyst integration. The flaw is a local information-disclosure and privilege-escalation concern (CWE-276, CVSS 6.8) rather than a remote attack: it requires a shared multi-user system, an ordinary local login, no user interaction, and no elevated privileges, and yields only read impact (confidentiality) with no integrity or availability loss. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the vendor has released a fix in version 4.10.0.