5.3
Medium
CVE-2024-52313 An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the…
Description
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| data.all 1.0 | 1.0.0 → 2.6.0 | No fix stated |
Other CVEs of data.all
The 5 CVEs of data.all →
CVE-2024-52314
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able…
6.9
Medium
CVE-2024-52312
Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to…
5.3
Medium
CVE-2024-10953
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in…
5.3
Medium
CVE-2024-52311
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously…
5.3
Medium