{"id":"CVE-2018-19981","details":"Amazon AWS SDK \u003c=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service. An attacker can use these credentials to create authenticated and/or authorized requests. Note that the attacker must have \"root\" privilege access to the Android filesystem in order to exploit this vulnerability (i.e. the device has been compromised, such as disabling or bypassing Android's fundamental security mechanisms).","modified":"2026-07-08T19:50:48.770881Z","published":"2019-04-04T15:29:01.110Z","references":[{"type":"EVIDENCE","url":"https://aws-amplify.github.io/aws-sdk-android/docs/reference/com/amazonaws/auth/CognitoCachingCredentialsProvider.html"},{"type":"EVIDENCE","url":"https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_01.png"},{"type":"EVIDENCE","url":"https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_02.png"},{"type":"EVIDENCE","url":"https://raw.githubusercontent.com/lorenzodifuccia/cloudflare/master/Images/vulns/aws/aws_sdk_sp_03.png"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aws-amplify/aws-sdk-android","events":[{"introduced":"0"},{"last_affected":"585de89d15874d5875230df8be075a6d7e960a7b"}],"database_specific":{"cpe":"cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:android:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.8.5"}],"source":"CPE_RANGE"}}],"versions":["release_v2.8.5","release_v2.8.4","release_v2.8.3","release_v2.8.2","release_v2.8.1","release_v2.8.0","release_v2.7.7","release_v2.7.6","release_v2.7.5","release_v2.7.4","release_v2.7.3","release_v2.7.2","release_v2.7.1","release_v2.7.0","release_v2.6.31","release_v2.6.30","release_v2.6.29","release_v2.6.28","release_v2.6.27","release_v2.6.26","release_v2.6.25","release_v2.6.24","release_v2.6.23","release_v2.6.22","release_v2.6.21","release_v2.6.20","release_v2.6.19","release_v2.6.18","release_v2.6.17","release_v2.6.16","release_v2.6.15","release_v2.6.14","release_v2.6.13","release_v2.6.12","release_v2.6.11","release_v2.6.10","release_v2.6.9","release_v2.6.8","release_v2.6.7","release_v2.6.6","release_v2.6.5","release_v2.6.4","release_v2.6.3","release_v2.6.2","release_v2.6.1","release_v2.6.0","release_v2.4.7","release_v2.4.6","release_v2.4.5","release_v2.4.4","release_v2.4.3","release_v2.4.2","release_v2.4.1","release_v2.4.0","release_v2.3.9","release_v2.3.8","release_v2.3.7","release_v2.3.6","release_v2.3.5","release_v2.3.4","release_v2.3.3","release_v2.3.2","release_v2.3.1","release_v2.3.0","release_v2.2.22","release_v2.2.21","release_v2.2.20","release_v2.2.19","release_v2.2.18","release_v2.2.17","release_v2.2.16","release_v2.2.15","release_v2.2.14","release_v2.2.13","release_v2.2.12","release_v2.2.11","release_v2.2.10","release_v2.2.9","release_v2.2.8","release_v2.2.7","release_v2.2.6","release_v2.2.5","release_v2.2.4","release_v2.2.3","release_v2.2.2","release_v2.2.1","release_v2.2.0","release_v2.1.10","release_v2.1.9","release_v2.1.8","release_v2.1.7","release_v2.1.1_general_availability","release_v2.1.0","release_v2.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19981.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/aws/aws-sdk-php","events":[{"introduced":"0"},{"last_affected":"ec34eddcff0b7385afdb474ce3705580f7116294"}],"database_specific":{"cpe":"cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:android:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.8.5"}],"source":"CPE_RANGE"}}],"versions":["2.8.5","2.8.4","2.8.3","2.8.2","2.8.1","2.7.26","2.8.0","2.7.27","2.7.25","2.7.24","2.7.23","2.7.22","2.7.21","2.7.20","2.7.19","2.7.18","2.7.17","2.7.16","2.7.15","2.7.14","2.7.13","2.7.12","2.7.11","2.7.10","2.7.9","2.7.8","2.7.7","2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.16","2.6.15","2.6.14","2.6.13","2.6.12","2.6.11","2.6.10","2.6.9","2.6.8","2.6.7","2.6.6","2.6.5","2.6.4","2.6.3","2.6.2","2.6.1","2.6.0","2.5.4","2.5.3","2.5.2","2.5.1","2.5.0","2.4.12","2.4.11","2.4.10","2.4.9","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","2.4.2","2.4.1","2.4.0","2.3.4","2.3.3","2.3.2","2.3.1","2.3.0","2.2.1","2.2.0","2.1.2","2.1.1","2.1.0","2.0.3","2.0.2","2.0.1","2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19981.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}