CVE-2024-10953
Last modified
CVE-2024-10953 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Data.All | >= 1.0.0, < 2.6.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-10953?
How severe is CVE-2024-10953?
How do I fix CVE-2024-10953?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-10946A vulnerability classified as critical has been found in Gua…7.2
- CVE-2024-10947A vulnerability classified as critical was found in Guangzho…7.2
- CVE-2024-10948A vulnerability in the upload function of binary-husky/gpt_a…6.5
- CVE-2024-1095The Build & Control Block Patterns – Boost up Gutenberg Edit…5.3
- CVE-2024-10950In binary-husky/gpt_academic version <= 3.83, the plugin `Co…8.8
- CVE-2024-10952The The Authors List plugin for WordPress is vulnerable to a…7.3
- CVE-2024-10954In the `manim` plugin of binary-husky/gpt_academic, versions…8.8
- CVE-2024-10955A Regular Expression Denial of Service (ReDoS) vulnerability…6.5
- CVE-2024-10956GPT Academy version 3.83 in the binary-husky/gpt_academic re…7.1
- CVE-2024-10957The UpdraftPlus: WP Backup & Migration Plugin plugin for Wor…8.8
- CVE-2024-10958The The WP Photo Album Plus plugin for WordPress is vulnerab…7.3
- CVE-2024-10959The The Active Products Tables for WooCommerce. Use construc…7.3
Are you affected by CVE-2024-10953?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST