Vulnerability Description
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Data.All | >= 1.0.0, < 2.6.1 |
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/AWS-2024-013Vendor Advisory
- https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
- https://github.com/data-dot-all/dataall/security/advisories/GHSA-p2h8-r28g-5q6hVendor Advisory
FAQ
What is CVE-2024-52314?
CVE-2024-52314 is a vulnerability with a CVSS score of 4.9 (MEDIUM). A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log ...
How severe is CVE-2024-52314?
CVE-2024-52314 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-52314?
Check the references section above for vendor advisories and patch information. Affected products include: Amazon Data.All.