CVE-2024-10953

概要

参考情報

• aws.amazon.com/security/security-bulletins/AWS-2024-013 · Vendor Advisory
• data-dot-all/dataall release v2.6.1
• data-dot-all/dataall security advisory · Vendor Advisory

data.all のその他の脆弱性

• CVE-2024-52314中 4.9A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data fr…
• CVE-2024-52313中 4.3An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment res…
• CVE-2024-52312中 5.4Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted oper…
• CVE-2024-52311中 6.3Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue …