Aws Tools For Powershell
Monthly
Cleartext IAM user Management Console passwords can be captured into PowerShell transcripts and other log artifacts by AWS Tools for PowerShell versions prior to 5.0.306, letting a local user who already has read access to those files recover live console credentials. Exploitation requires three conditions to coincide: an operator runs a pre-5.0.306 cmdlet that generates or returns an IAM user's cleartext console password, that command output is written to a persistent artifact such as a Start-Transcript file or redirected log store, and the attacker already holds a local foothold with read rights on the host - conditions that keep this at CVSS 5.9 (AV:L/AC:L/PR:L/UI:R) and make it a moderate-priority, defense-in-depth issue rather than an urgent threat. There is no public exploit identified at time of analysis; the vendor has released 5.0.306 and advises reviewing existing transcripts and rotating any IAM console passwords that may have been exposed.
Cleartext IAM user Management Console passwords can be captured into PowerShell transcripts and other log artifacts by AWS Tools for PowerShell versions prior to 5.0.306, letting a local user who already has read access to those files recover live console credentials. Exploitation requires three conditions to coincide: an operator runs a pre-5.0.306 cmdlet that generates or returns an IAM user's cleartext console password, that command output is written to a persistent artifact such as a Start-Transcript file or redirected log store, and the attacker already holds a local foothold with read rights on the host - conditions that keep this at CVSS 5.9 (AV:L/AC:L/PR:L/UI:R) and make it a moderate-priority, defense-in-depth issue rather than an urgent threat. There is no public exploit identified at time of analysis; the vendor has released 5.0.306 and advises reviewing existing transcripts and rotating any IAM console passwords that may have been exposed.