Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-52313

data.all authenticated users can obtain incorrect object level authorizations

Description

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

amazon data.all

Default version status: unaffected

  • 1.0.0 to ≤ 2.6.0affected

References