CVE-2024-10953
data.all authenticated users can perform mutating update operations on persisted notification records
Résumé
data.all authenticated users can perform mutating update operations on persisted notification records
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory aws.amazon.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com