CVE-2024-52313: Amazon Data.all

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.

Affected products

• Amazon Data.all: from 1.0.0, before 2.6.1 (fixed in 2.6.1)

Published 2024-11-09. Last modified 2026-06-17.