Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-10953

data.all authenticated users can perform mutating update operations on persisted notification records

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMZN

Description

An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

amazon data.all

Default version status: unaffected

  • 1.0.0 to ≤ 2.6.0affected

References