{"id":"CVE-2023-50928","aliases":["EUVD-2023-55659","GHSA-cg8w-7q5v-g32r"],"status":"published","title":"sandbox-accounts-for-events security misconfiguration leads to budget exceed","description":"\"Sandbox Accounts for Events\" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget \u0026 duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00376,"percentile":0.3185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2023-12-22T21:00:49Z","modified":"2026-10-28T02:30:51Z","products":[{"vendor":"amazon","product":"awslabs_sandbox_accounts_for_events"},{"vendor":"awslabs","product":"sandbox-accounts-for-events"}],"references":[{"url":"https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32r","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50928.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50928","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-50928","title":" sandbox-accounts-for-events security misconfiguration leads to budget exceed","description":"\"Sandbox Accounts for Events\" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget \u0026 duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.","status":"published","published":"2023-12-22T21:00:49.814Z","modified":"2024-08-02T22:23:43.827Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:34.923818Z"}],"euvd":[{"id":"EUVD-2023-55659","description":"\"Sandbox Accounts for Events\" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget \u0026 duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.","status":"published","published":"2023-12-22T21:00:49Z","modified":"2024-08-02T22:23:43Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T03:26:07.661682Z"}],"nvd":[{"id":"CVE-2023-50928","description":"\"Sandbox Accounts for Events\" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget \u0026 duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.","status":"published","published":"2023-12-22T21:15:08.58Z","modified":"2026-06-17T06:40:15.18Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"CVE-2023-50928","title":" sandbox-accounts-for-events security misconfiguration leads to budget exceed","description":"\"Sandbox Accounts for Events\" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget \u0026 duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.","status":"published","published":"2023-12-22T21:00:49.814Z","modified":"2026-10-28T02:30:51.716860491Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:35.245372Z"}]}}