Unrated severityNVD Advisory· Published Nov 9, 2024· Updated Oct 14, 2025
data.all authenticated users can obtain incorrect object level authorizations
CVE-2024-52313
Description
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.
Affected products
2- amazon/data.allv5Range: 1.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/data-dot-all/dataall/releases/tag/v2.6.1mitrepatch
- aws.amazon.com/security/security-bulletins/AWS-2024-013mitrevendor-advisory
- github.com/data-dot-all/dataall/security/advisories/GHSA-hx8q-7wxv-6c7cmitrethird-party-advisory
News mentions
0No linked articles in our index yet.