Approved changes feed: RSS · Atom
cpe:2.3:a:amazon:data.all:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Amazon (0ed129a9-8e26-53dc-aefe-55957e638c30) |
|---|---|
| Product | Data.All (6ba996e4-1f8b-5ab1-8043-de28eb940ca3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-52314 |
vulnerable | 2026-06-08 06:52:14.766862 |
data.all admin user may access potentially sensitive data stored by producers via logs
MEDIUM (4.9)
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.
Published: 2024-11-09T00:43:10.397Z
Updated: 2025-10-14T19:01:19.396Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52313 |
vulnerable | 2026-06-08 06:52:14.766471 |
data.all authenticated users can obtain incorrect object level authorizations
MEDIUM (4.3)
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.
Published: 2024-11-09T00:43:00.250Z
Updated: 2025-10-14T19:26:56.176Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52312 |
vulnerable | 2026-06-08 06:52:14.766049 |
data.all authenticated users can perform restricted operations against DataSets and Environments
MEDIUM (5.4)
Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.
Published: 2024-11-09T00:43:04.986Z
Updated: 2025-10-14T19:02:40.936Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52311 |
vulnerable | 2026-06-08 06:52:14.765565 |
data.all does not invalidate authentication token upon user logout
MEDIUM (6.3)
Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.
Published: 2024-11-09T00:42:49.246Z
Updated: 2025-10-14T19:25:04.120Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10953 |
vulnerable | 2026-06-08 06:23:48.262798 |
data.all authenticated users can perform mutating update operations on persisted notification records
MEDIUM (4.3)
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.
Published: 2024-11-09T00:42:55.584Z
Updated: 2025-10-14T19:03:41.864Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.