Elasticache cluster can be accessed without authentication token Affecting ElastiCache service in AWS
Severity Framework
Snyk CCSS
Rule category
Keys and Secrets / Access
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CSA-CCM
- Snyk ID SNYK-CC-00319
- credit Snyk Research Team
Description
Anyone with network access to the cluster can read cached data.
How to fix?
Add an external reference to AuthToken
. Do not add the secret directly into the file.