CVE-2025-12815

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate this issue, users should upgrade to version 2025.09 or above.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/AWS-2025-026/
https://github.com/aws/res/releases/tag/2025.09
https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv

Configurations

No configuration.

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un problema de verificación de propiedad en la página de vista previa del Escritorio Virtual en el Research and Engineering Studio (RES) en AWS antes de la versión 2025.09 podría permitir a un usuario remoto autenticado ver los metadatos de la sesión de escritorio activa de otro usuario, incluyendo capturas de pantalla periódicas de la vista previa del escritorio. Para mitigar este problema, los usuarios deberían actualizar a la versión 2025.09 o superior.

Information

Published : 2025-11-06 18:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-12815

Mitre link : CVE-2025-12815

CVE.ORG link : CVE-2025-12815

JSON object : View

Products Affected

No product.

CWE

CWE-283

Unverified Ownership

{"id": "CVE-2025-12815", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12815", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-06T17:24:29.073773Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "Research and Engineering Studio (RES)", "versions": [{"status": "unaffected", "version": "2025.09"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-06T18:15:39.700", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-026/", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/res/releases/tag/2025.09", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-283"}]}], "descriptions": [{"lang": "en", "value": "An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. \n\nTo mitigate this issue, users should upgrade to version 2025.09 or above."}, {"lang": "es", "value": "Un problema de verificaci\u00f3n de propiedad en la p\u00e1gina de vista previa del Escritorio Virtual en el Research and Engineering Studio (RES) en AWS antes de la versi\u00f3n 2025.09 podr\u00eda permitir a un usuario remoto autenticado ver los metadatos de la sesi\u00f3n de escritorio activa de otro usuario, incluyendo capturas de pantalla peri\u00f3dicas de la vista previa del escritorio.\n\nPara mitigar este problema, los usuarios deber\u00edan actualizar a la versi\u00f3n 2025.09 o superior."}], "lastModified": "2026-10-07T21:10:00.200", "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}