CVE-2024-52312

概要

参考情報

• aws.amazon.com/security/security-bulletins/AWS-2024-013 · Vendor Advisory
• data-dot-all/dataall release v2.6.1
• data-dot-all/dataall security advisory · Vendor Advisory

data.all のその他の脆弱性

• CVE-2024-52314中 4.9A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data fr…
• CVE-2024-52313中 4.3An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment res…
• CVE-2024-52311中 6.3Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue …
• CVE-2024-10953中 4.3An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notific…