What is CVE-2024-52313?

CVE-2024-52313 is a medium-severity vulnerability in Amazon Data.all, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2024-11-09.

How severe is CVE-2024-52313?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Amazon Data.all

CVE-2024-52313

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.003 (22.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Amazon Data.all — versions 1.0.0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory, Vendor Advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (Vendor Advisory, third-party-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (patch)

Frequently asked questions

What is CVE-2024-52313?: CVE-2024-52313 is a medium-severity vulnerability in Amazon Data.all, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2024-11-09.
How severe is CVE-2024-52313?: Medium severity. CVSS v3 base score is 4.3 out of 10.