CVE-2024-52313

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-523144.9A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data fr CVE-2024-523169.8Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) S CVE-2024-523176.5Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 reques CVE-2024-523186.1Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are CVE-2024-523197.8In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hu CVE-2024-52326.5A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an CVE-2024-523209.8The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request CVE-2024-523215.9Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files con CVE-2024-523225.5WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure,CVE-2024-523238.1Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to r CVE-2024-523249.8Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send CVE-2024-523259.6ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.