Login Request a demo
Medium severity · published Nov 9, 2024
CVE-2024-52314
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in…
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Data.all · Amazon
1.0.0 before 2.6.1 · source: NVD
Affected product
DA
Data.all
Amazon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52314
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52314
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2024-013
github.com
https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
Vendor Advisory
https://github.com/data-dot-all/dataall/security/advisories/GHSA-p2h8-r28g-5q6h
More from Data.all
6.3
CVE-2024-52311
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests…
5.4
CVE-2024-52312
Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and…
4.3
CVE-2024-52313
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not…
4.3
CVE-2024-10953
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member…