7.5High
CVE-2025-0500Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients
Description
An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.
Weakness (CWE):
CWE-295
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Amazon | AppStream 2.0 Client | 1.1.1025 – < 1.1.1332 | |
| Amazon | DCV Client | < 2023.1.6703 | |
| Amazon | WorkSpaces Client | 5.0.0 – < 5.21.0 |
References and patches
- https://aws.amazon.com/security/security-bulletins/AWS-2025-001/ vendor-advisory
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes patchrelease-notes
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes patchrelease-notes
- https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes patchrelease-notes
- https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.html patchrelease-notes
- https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388jul patchrelease-notes