CVE-2025-12815CWE-283

CVE-2025-12815

Medium · published November 6, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots.

To mitigate this issue, users should upgrade to version 2025.09 or above.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.8th percentile
Weakness
CWE-283 · Unverified Ownership
Published
2025-11-06T23:15Z
References (3)
https://aws.amazon.com/security/security-bulletins/AWS-2025-026/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/res/releases/tag/2025.09 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 06 NOV 17:10Z
    An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an…
    cvelistv5