Vulnerability Description
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Data.All | >= 1.0.0, < 2.6.1 |
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/AWS-2024-013Vendor Advisory
- https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
- https://github.com/data-dot-all/dataall/security/advisories/GHSA-hx8q-7wxv-6c7cVendor Advisory
FAQ
What is CVE-2024-52313?
CVE-2024-52313 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by dir...
How severe is CVE-2024-52313?
CVE-2024-52313 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-52313?
Check the references section above for vendor advisories and patch information. Affected products include: Amazon Data.All.