PT-2024-35173 · Amazon · Alldata

Noah-Paige · CVE-2024-52313 · Published 2024-11-08 · Updated 2025-10-14

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Amazon data.all versions <=2.6.0

Description An authenticated data.all user can manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not be able to fetch by directly querying the object via getEnvironment in data.all. This issue is related to incorrect authorization and can be remotely exploited.

Recommendations For Amazon data.all versions <=2.6.0, upgrade to a patched version immediately to resolve the issue. As a temporary workaround, consider restricting access to the getDataset query to minimize the risk of exploitation.

Exploit

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2024-52313

GHSA-HX8Q-7WXV-6C7C

Affected Products

Alldata

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52313.json · Exploit
• https://github.com/data-dot-all/dataall/security/advisories/GHSA-hx8q-7wxv-6c7c · Vendor Advisory
• https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 · Patch
• https://osv.dev/vulnerability/CVE-2024-52313 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2024-013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52313 · Security Note
• https://t.me/cvedetector/10250 · Telegram Post
• https://t.me/cvenotify/101163 · Telegram Post
• https://t.me/cvenotify/101158 · Telegram Post
• https://twitter.com/CVEnew/status/1855072946684932323 · Twitter Post
• https://twitter.com/oktsec/status/1855092366241153142 · Twitter Post
• https://t.me/cveNotify/138670 · Telegram Post
• https://t.me/cveNotify/138637 · Telegram Post
• https://t.me/cveNotify/135953 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1855200391702405597 · Twitter Post