CVE-2024-52312 — Vulnetix

CVE-2024-52312 PUBLISHED CVSS 5.300000190734863 MEDIUM

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.

EPSS 0.12% · 30.4th percentile

Risk Scores

CVSS 4.0

5.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS Score

0.12%

30.4th percentile

Affected Products

Vendor	Product	Versions
amazon	data.all	1.0.0, 1.0.0

Exploit Intelligence

CIRCL seen: CVE-2024-52312 (circl-sighting)
https://aws.amazon.com/security/security-bulletins/AWS-2024-013 (circl)
https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9 (circl)
https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 (circl)

Timeline

Nov 9, 2024 EPSS Score
Nov 9, 2024 Coalition ESS Score
Nov 9, 2024 Coalition ESS Score
Nov 9, 2024 CVE Published
Nov 12, 2024 Coalition ESS Score
Nov 27, 2024 EPSS Score
Dec 16, 2024 EPSS Score
Jan 2, 2025 EPSS Score
Jan 20, 2025 EPSS Score
Feb 7, 2025 EPSS Score
Feb 25, 2025 EPSS Score
Mar 15, 2025 EPSS Score

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-013 vendor-advisory
https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9 third-party-advisory
https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 patch

Open in Interactive Console →