Description (CNA)
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| amazon / data.all | affected 1.0.0 through 2.6.0 |
CWE
CWE-863
References
- https://aws.amazon.com/security/security-bulletins/AWS-2024-013
- https://github.com/data-dot-all/dataall/security/advisories/GHSA-x4j5-jm65-vp5j
- https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
ADP enrichment
No English description supplied.
No references supplied.