CVE-2025-0500

Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients

State: Published
Severity: 7.7 High
Published: Jan 15, 2025
Updated: Oct 14, 2025
Reserved: Jan 15, 2025

Description

An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	AMZN

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
WorkSpaces ClientAmazon	5.0.0 to before 5.21.0Affected
WorkSpaces ClientAmazon	2023.0 to before 2024.2Affected
AppStream 2.0 ClientAmazon	1.1.1025 to before 1.1.1332Affected
DCV ClientAmazon	before 2023.1.6703Affected
DCV ClientAmazon	2020.2.7459 to before 2023.1.9127Affected
WorkSpaces ClientAmazon	5.5.0 to before 5.21.0Affected
DCV ClientAmazon	2020.2.2078 to before 2023.1.6703Affected

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-001/vendor-advisory
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notespatchrelease-notes
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notespatchrelease-notes
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notespatchrelease-notes
https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.htmlpatchrelease-notes
https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388julpatchrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.