CVE-2024-52314

MEDIUM

4.9

Description

A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.

Details CVE

Score CVSS v3.14.9

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisHIGH

Interaction utilisateurNONE

Publie11/9/2024

Derniere modification10/14/2025

Sourcenvd

Observations honeypot0

Produits affectes

amazon:data.all

Faiblesses (CWE)

CWE-863

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-013(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/data-dot-all/dataall/releases/tag/v2.6.1(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/data-dot-all/dataall/security/advisories/GHSA-p2h8-r28g-5q6h(ff89ba41-3aa1-4d27-914a-91399e9639e5)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.