← All vulnerabilities

Cloud IAM Misconfiguration

Critical · Cloud

OWASP Top 10:2025 (current)

Not directly mapped to a Top 10:2025 category — see CWE / CVE below.

CWE

CWE-284

CVE / class examples

Search NVD/CVE for product-specific instances of this CWE

All refs

CWE-284

Definition

Wildcard IAM, public buckets, open security groups.

Root cause

Click-deploy defaults; no guardrails.

Affected components

Components in the “Cloud” class
Application / API handlers
Supporting libraries

Impact

Data breach, crypto mining, ransomware.

Severity

Critical · CVSS 9.8

Safe lab reproduction

lab-iam-advanced

Detection methodology

CSPM (Prowler/ScoutSuite).

Evidence examples

Lab reproduction notes: lab-iam-advanced
Request/response excerpts (redacted)
Detection signal: CSPM (Prowler/ScoutSuite)

Remediation

Least privilege; SCPs; IaC scanning.

Secure coding examples

Enable CloudTrail/logging; MFA on root.

Related CYNARKS lessons & labs

Tools: prowler · aws-cli

Practise related skills in Labs or deepen on Academy library.