CVE-2024-52313CWE-639

data.all authenticated users can obtain incorrect object level authorizations

Medium · published November 9, 2024

CVSS v4.0
5.3
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00313 · 22.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-11-09T00:43Z
EPSS history
Timeline
  • 09 NOV 00:43Z
    data.all authenticated users can obtain incorrect object level authorizations
    cvelistv5