{"id":"CVE-2025-12815","state":"PUBLISHED","title":"An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote use","description":"An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. \n\nTo mitigate this issue, users should upgrade to version 2025.09 or above.","publishedAt":"2025-11-06T17:10:34.559Z","updatedAt":"2025-11-12T15:30:15.903Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","source":"AMZN"},"assigner":"AMZN","products":["AWS Research and Engineering Studio (RES)"],"affected":[{"vendor":"AWS","product":"Research and Engineering Studio (RES)","defaultStatus":"unaffected","versions":[{"version":"2025.09","status":"unaffected"}]}],"references":["https://aws.amazon.com/security/security-bulletins/AWS-2025-026/","https://github.com/aws/res/releases/tag/2025.09","https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv"],"weaknesses":["CWE-283"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/12xxx/CVE-2025-12815.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-12815","state":"PUBLISHED","datePublished":"2025-11-06T17:10:34.559Z","dateUpdated":"2025-11-12T15:30:15.903Z","assignerShortName":"AMZN","assignerOrgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","dateReserved":"2025-11-06T16:58:30.192Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. \n\nTo mitigate this issue, users should upgrade to version 2025.09 or above."}],"affected":[{"vendor":"AWS","product":"Research and Engineering Studio (RES)","defaultStatus":"unaffected","versions":[{"version":"2025.09","status":"unaffected"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2025-026/","tags":["vendor-advisory"]},{"url":"https://github.com/aws/res/releases/tag/2025.09","tags":["patch"]},{"url":"https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-283","description":"CWE-283: Unverified Ownership","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"AMZN","orgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","dateUpdated":"2025-11-06T17:40:11.560Z"},"impacts":[{"capecId":"CAPEC-508","descriptions":[{"lang":"en","value":"CAPEC-508: Shoulder Surfing"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-06T17:24:29.073773Z","id":"CVE-2025-12815","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-12T15:30:15.903Z"}}]}}}