Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-52312

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.

Published

2024-11-09T01:15:04.753

Last Modified

2025-10-14T19:15:36.777

Status

Modified

Source

ff89ba41-3aa1-4d27-914a-91399e9639e5

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses

Type: Secondary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	amazon	data.all	< 2.6.1	Yes

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-013 Vendor Advisory (ff89ba41-3aa1-4d27-914a-91399e9639e5)
https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 (ff89ba41-3aa1-4d27-914a-91399e9639e5)
https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9 Vendor Advisory (ff89ba41-3aa1-4d27-914a-91399e9639e5)