GitHub Advisoryadvisory · PyPI
GHSA-59qj-jcjv-662j DIRAC's TokenManager does not check permissions on cached tokens
CRITICAL
Official page ↗
- Aliases
- CVE-2024-24825
- Ecosystem
- PyPI
- Packages
- DIRAC, dirac
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2024-02-08
Affected packages
• PyPI DIRAC: >= 8.0.0, < 8.0.37 → fixed in 8.0.37
• PyPI dirac: < 8.0.37 → fixed in 8.0.37
Description
Impact
Any user could get a token that has been requested by another user/agent
Patches
The vulnerability is fixed in version 8.0.37.
Workarounds
None
References
Related
Alias · CVE (1)
- CVE-2024-24825 DIRAC is a distributed resource framework. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j web
- https://nvd.nist.gov/vuln/detail/CVE-2024-24825 advisory
- https://github.com/DIRACGrid/DIRAC/commit/9487921684e2925b4cf72d6c423718cf4950f3fe web
- https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c web
- https://github.com/DIRACGrid/DIRAC package
- https://github.com/pypa/advisory-database/tree/main/vulns/dirac/PYSEC-2024-125.yaml web