CVE-2024-52311CWE-613

data.all does not invalidate authentication token upon user logout

Medium · published November 9, 2024

CVSS v4.0
5.3
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2024-11-09T00:42Z
EPSS history
Timeline
  • 09 NOV 00:42Z
    data.all does not invalidate authentication token upon user logout
    cvelistv5