Amazon Data.all
5 CVEs affecting Amazon Data.all. Latest disclosed: 2024-11-09. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52311 | Medium | 6.3 | 2024-11-09 | Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of author… |
CVE-2024-52312 | Medium | 5.4 | 2024-11-09 | Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against Data… |
CVE-2024-52314 | Medium | 4.9 | 2024-11-09 | A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all applica… |
CVE-2024-52313 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user… |
CVE-2024-10953 | Medium | 4.3 | 2024-11-09 | An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their u… |