Threats tagged 'ghsa-w2r9-8jfw-7fpr'

A command injection vulnerability exists in the FSx Windows File Server volume mounting component of the Amazon ECS Agent on Windows versions prior to 1.103.0. An authenticated attacker with permissions to register ECS task definitions or modify Secrets Manager or SSM Parameter Store credentials can exploit this flaw by crafting a malicious username field in an ECS task definition, leading to execution of shell commands with SYSTEM privileges on the host. This vulnerability is addressed by upgrading to version 1.103.0.