Medium severity · published Nov 9, 2024
CVE-2024-52313
data.all authenticated users can obtain incorrect object level authorizations
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
data.all · amazon
1.0.0 through 2.6.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52313
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52313
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2024-013
github.com
https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
Vendor Advisory
https://github.com/data-dot-all/dataall/security/advisories/GHSA-hx8q-7wxv-6c7c
More from data.all
6.3
CVE-2024-52311
data.all does not invalidate authentication token upon user logout
5.4
CVE-2024-52312
data.all authenticated users can perform restricted operations against DataSets and Environments
4.9
CVE-2024-52314
data.all admin user may access potentially sensitive data stored by producers via logs
4.3
CVE-2024-10953
data.all authenticated users can perform mutating update operations on persisted notification records