Skip to content
OpenAdvisories
Medium · 5.4 CVE-2024-52312 EUVD-2024-45841

data.all authenticated users can perform restricted operations against DataSets and Environments

Published Nov 9, 2024 · Updated Oct 14, 2025 · Assigned by AMZN

Description

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.

Affected products

VendorProductAffectedFixed
amazon data.all 1.0.0 – ≤ 2.6.0 —

References