CVE-2024-52312

data.all authenticated users can perform restricted operations against DataSets and Environments

CVSS 5.3 MEDIUMEPSS 0.3%CWE-863

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Affected products

amazon · data.all

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-013 https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9