CVE-2025-12815

Published: Nov 6, 2025Modified: Jun 17, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate this issue, users should upgrade to version 2025.09 or above.

Related CWEs

CWE-283

Unverified Ownership

The product does not properly verify that a critical resource is owned by the proper entity.

References (3)

https://aws.amazon.com/security/security-bulletins/AWS-2025-026/

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/aws/res/releases/tag/2025.09

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Timeline

No history available yet.