Amazon Connect Salesforce Lambda
Approved changes feed: RSS · Atom
cpe:2.3:a:amazon:amazon-connect-salesforce-lambda:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Amazon (0ed129a9-8e26-53dc-aefe-55957e638c30) |
|---|---|
| Product | Amazon Connect Salesforce Lambda (b643ddd2-dfb3-55c3-810a-2db88088c2eb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-94384 |
vulnerable | 2026-10-13 12:28:38.800835 |
Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda
HIGH (8.1)
Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation.
To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only.
Published: 2026-09-22T17:07:12.861Z
Updated: 2026-09-22T18:25:01.089Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.