PT-2024-35173 · Amazon · Alldata

Noah-Paige · Published 2024-11-08 · Updated 2025-10-14 · CVE-2024-52313

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon data.all versions <=2.6.0

Description An authenticated data.all user can manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not be able to fetch by directly querying the object via getEnvironment in data.all. This issue is related to incorrect authorization and can be remotely exploited.

Recommendations For Amazon data.all versions <=2.6.0, upgrade to a patched version immediately to resolve the issue. As a temporary workaround, consider restricting access to the getDataset query to minimize the risk of exploitation.

Fix

Incorrect Authorization

IDOR

Weakness Enumeration

CWE-863

CWE-639

Related Identifiers

CVE-2024-52313

GHSA-HX8Q-7WXV-6C7C

Affected Products

Alldata

References · 14

• https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 · Patch
• https://github.com/data-dot-all/dataall/security/advisories/GHSA-hx8q-7wxv-6c7c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52313 · Security Note
• https://aws.amazon.com/security/security-bulletins/AWS-2024-013 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52313 · Vendor Advisory
• https://twitter.com/CVEnew/status/1855072946684932323 · Twitter Post
• https://twitter.com/oktsec/status/1855092366241153142 · Twitter Post
• https://t.me/cveNotify/135953 · Telegram Post
• https://t.me/cveNotify/138637 · Telegram Post
• https://t.me/cvenotify/101163 · Telegram Post
• https://t.me/cveNotify/138670 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1855200391702405597 · Twitter Post
• https://t.me/cvedetector/10250 · Telegram Post
• https://t.me/cvenotify/101158 · Telegram Post