CVE-2024-52313 — data.all authenticated users can obtain incorrect object level authorizations
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would n…
Published: 2024-11-09 · CVSS: 5.3 · CVSS 4.0
An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7