6.9
Moyenne
CVE-2024-52314 A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able…
Description
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| data.all 1.0 | 1.0.0 → 2.6.0 | Pas de correctif indiqué |
Autres CVE de data.all
Les 5 CVE de data.all →
CVE-2024-52312
Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to…
5.3
Moyenne
CVE-2024-52313
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the…
5.3
Moyenne
CVE-2024-10953
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in…
5.3
Moyenne
CVE-2024-52311
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously…
5.3
Moyenne