CVE-2024-52314
A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data.
- Affected products
- Aws, Cloudwatch, Alldata
- Amazon Data.all
- < 2.6.1
- CVSS 4.0
- 6.9 MEDIUM
- CVSS 3.1
- 4.9 MEDIUM
- EPSS
- 0.4% (32th percentile)
- Weakness
- CWE-863
- NVD status
- Modified
- Published
- 2024-11-09
- Attack patterns
- CAPEC-122, CAPEC-180
Fix
A fix for this issue is available in data.all version 2.6.1 and later. Customers are advised to upgrade to version 2.6.1 or later.
CVE-2024-52314 at NVD
No indexed exploits for CVE-2024-52314 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-52314 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.