CVE-2024-10953

data.all authenticated users can perform mutating update operations on persisted notification records

CVSS 5.3 MEDIUMEPSS 0.3%CWE-863

An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

amazon · data.all

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://aws.amazon.com/security/security-bulletins/AWS-2024-013 https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 https://github.com/data-dot-all/dataall/security/advisories/GHSA-x4j5-jm65-vp5j