CVE-2024-52312

Published: Nov 9, 2024Modified: Oct 14, 2025

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.

Affected (1)

Products: Amazon: Data.all

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Amazon Data.all	From 1.0.0 to 2.6.1

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (3)

https://aws.amazon.com/security/security-bulletins/AWS-2024-013

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Vendor Advisory

https://github.com/data-dot-all/dataall/releases/tag/v2.6.1

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Vendor Advisory

Timeline

No history available yet.