CVE-2024-10953— data.all authenticated users can perform mutating update operations on persisted notification records
Quick assessment
Affected
amazon data.all
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
data.all是data-dot-all开源的一个开源开发框架。 data.all 2.6.0之前版本存在安全漏洞，该漏洞源于经过身份验证的用户能够对data.all中持久保存的通知记录执行变异UPDATE操作，以针对其用户不是其成员的组通知。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-10953
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
data.all authenticated users can perform mutating update operations on persisted notification records
Source: CVE Program / CVE List V5
Vulnerability Description
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
data.all 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
data.all是data-dot-all开源的一个开源开发框架。 data.all 2.6.0之前版本存在安全漏洞，该漏洞源于经过身份验证的用户能够对data.all中持久保存的通知记录执行变异UPDATE操作，以针对其用户不是其成员的组通知。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-10953
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-10953
请登录查看更多情报信息。
Same Patch Batch · amazon · 2024-11-09 · 5 CVEs total
| CVE-2024-52311 | 6.3 MEDIUM | data.all does not invalidate authentication token upon user logout |
| CVE-2024-52312 | 5.4 MEDIUM | data.all authenticated users can perform restricted operations against DataSets and Enviro |
| CVE-2024-52314 | 4.9 MEDIUM | data.all admin user may access potentially sensitive data stored by producers via logs |
| CVE-2024-52313 | 4.3 MEDIUM | data.all authenticated users can obtain incorrect object level authorizations |
IV. Related Vulnerabilities
Same product: data.all
-
CVE-2024-52314
data.all admin user may access potentially sensitive data st -
CVE-2024-52312
data.all authenticated users can perform restricted operatio -
CVE-2024-52313
data.all authenticated users can obtain incorrect object lev -
CVE-2024-52311
data.all does not invalidate authentication token upon user
Same vendor: amazon
-
CVE-2026-18657
Executable Resolution from Untrusted Project Directory in Ki -
CVE-2026-18656
Executable Resolution from Untrusted Project Directory in Ki -
CVE-2026-16318
QUIC Transport Parameters Memory Leak During HelloRetryReque -
CVE-2026-15746
Credential disclosure in Strands Agents Tools elasticsearch_ -
CVE-2026-15738
Cross-namespace traffic interception via incorrect route pre
Same weakness: CWE-863
-
CVE-2025-63080
Authenticated RCE in KAON PG5298 -
CVE-2026-62382
PasswordPusher before v2.9.6 Authentication Bypass via Null -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-77234
Improper input validation in FreeRTOS-Kernel timer command h
V. Comments for CVE-2024-10953
No comments yet