CVE-2022-23511
First published: Mon Dec 12 2022(Updated: )
A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon CloudWatch Agent | <1.247355 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this privilege escalation issue in Amazon CloudWatch Agent for Windows?
The vulnerability ID for this issue is CVE-2022-23511.
What is the severity of CVE-2022-23511?
The severity of CVE-2022-23511 is high with a CVSS score of 6.8.
What is the affected software for CVE-2022-23511?
The affected software for CVE-2022-23511 is Amazon CloudWatch Agent for Windows versions up to and including v1.247354.
How does the privilege escalation vulnerability in Amazon CloudWatch Agent for Windows occur?
The privilege escalation vulnerability in Amazon CloudWatch Agent for Windows occurs when users trigger a repair of the Agent, which opens a pop-up window with SYSTEM permissions.
Is Microsoft Windows affected by this vulnerability (CVE-2022-23511)?
No, Microsoft Windows is not affected by this vulnerability (CVE-2022-23511).
How can I fix the privilege escalation vulnerability in Amazon CloudWatch Agent for Windows?
To fix the privilege escalation vulnerability in Amazon CloudWatch Agent for Windows, users should update to version v1.247355 or later.
Where can I find more information about CVE-2022-23511?
You can find more information about CVE-2022-23511 at the following references: [Reference 1](https://github.com/aws/amazon-cloudwatch-agent/commit/6119858864c317ff26f41f576c169148d1250837#diff-76ed074a9305c04054cdebb9e9aad2d818052b07091de1f20cad0bbac34ffb52) and [Reference 2](https://github.com/aws/amazon-cloudwatch-agent/security/advisories/GHSA-j8x2-2m5w-j939).
- agent/references
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/severity
- agent/tags
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- vendor/amazon
- canonical/amazon cloudwatch agent
- vendor/microsoft
- canonical/microsoft windows