Exposure of Sensitive Information to an Unauthorized Actor
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
| OWASP | A01:2021 - Broken Access Control |
| Confidence Level | Low |
| Impact Level | Low |
| Likelihood Level | Low |
Description#
The IAM policy allows actions that can expose sensitive credentials in API responses, such as access keys or passwords. This increases the risk of accidentally leaking credentials to unauthorized users or external systems.
Impact#
If exploited, attackers could obtain valid AWS credentials or sensitive tokens, allowing them to access, modify, or control cloud resources. This may result in data breaches, resource compromise, or unauthorized access to critical infrastructure.