CVE-2024-52311

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Nov 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-523125.4Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted oper CVE-2024-523134.3An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment res CVE-2024-523144.9A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data fr CVE-2024-523169.8Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) S CVE-2024-523176.5Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 reques CVE-2024-523186.1Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are CVE-2024-523197.8In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hu CVE-2024-52326.5A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an CVE-2024-523209.8The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request CVE-2024-523215.9Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files con CVE-2024-523225.5WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure,CVE-2024-523238.1Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to r