CVE-2024-52313

Summary

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.

Affected Software

Weaknesses

• CWE-639: CWE-639 Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://aws.amazon.com/security/security-bulletins/AWS-2024-013
• https://github.com/data-dot-all/dataall/security/advisories/GHSA-hx8q-7wxv-6c7c
• https://github.com/data-dot-all/dataall/releases/tag/v2.6.1

• ←Previous
• Next→