Description (CNA)
Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| amazon / data.all | affected 1.0.0 through 2.6.0 |
CWE
CWE-863
References
- https://aws.amazon.com/security/security-bulletins/AWS-2024-013
- https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9
- https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
ADP enrichment
No English description supplied.
No references supplied.