CVE-2021-38112

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument. This is fixed in 3.1.9.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notesVendor Advisory
https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/Exploit, Third Party Advisory
https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notesVendor Advisory
https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/Exploit, Third Party Advisory

Timeline

Published: Sep 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381135.4In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the CVE-2021-381145.5libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.CVE-2021-381156.5read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-o CVE-2021-381168.8Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 CVE-2021-381179.8Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-381187.8Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-381196.1Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-38126.1adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-381207.2A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup CVE-2021-381218.8Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed CVE-2021-381228.2A Cross-Site Scripting vulnerable identified in NetIQ Advance Authentication that impacts the server functionality and disclose sensitive in CVE-2021-381236.1Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05