What’s Vulnerable › Vulnerabilities

CVE-2024-52312: data.all authenticated users can perform restricted operations against DataSets and Environments

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-09 · updated 2026-06-17
• Weakness: CWE-863

Description

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.

Affected products

• amazon data.all: from 1.0.0 before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: amazon data.all 2.6.1. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2024-013
• https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
• https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9

Get alerted when CVE-2024-52312 or the next vulnerability affects your stack