CVEvulnerability

CVE-2024-52311

5.3 MEDIUM Published 2024-11-09 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2024-11-09
Last modified: 2026-06-17
Assigner: ff89ba41-3aa1-4d27-914a-91399e9639e5
CVSS 4.0 (ff89ba41-3aa1-4d27-914a-91399e9639e5): 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 (ff89ba41-3aa1-4d27-914a-91399e9639e5): 6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses: CWE-613

Description

Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.

Affected configurations

• amazon data.all (>= 1.0.0 < 2.6.1)

Weakness · not in database (1)

CWE-613

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-013 Vendor Advisory
https://github.com/data-dot-all/dataall/releases/tag/v2.6.1 github.com
https://github.com/data-dot-all/dataall/security/advisories/GHSA-p69m-h9rw-584v Vendor Advisory

CVE-2024-52311

Description

Affected configurations

Related

Weakness · not in database (1)

References