CVE-2023-50928

    Dashboard / Vulnerabilities / CVE-2023-50928

    CVE-2023-50928

    Published: 22 Dec 2023Last Modified: 12 Aug 2026

    Summary: sandbox-accounts-for-events security misconfiguration leads to budget exceed

    Details: "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50928.json, https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32r, https://nvd.nist.gov/vuln/detail/CVE-2023-50928, https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f30a0662f0a28734eb33c5868cccc1c319eb6e79

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-50928 | CVE-DB