GHSA-59qj-jcjv-662jCriticalCVSS 9.1

DIRAC's TokenManager does not check permissions on cached tokens

Published
February 8, 2024
Last Modified
November 21, 2024

🔗 CVE IDs covered (1)

CVE-2024-24825 →

📋 Description

Impact

Any user could get a token that has been requested by another user/agent

Patches

The vulnerability is fixed in version 8.0.37.

Workarounds

None

References

🎯 Affected products2

  • pip/DIRAC:>= 8.0.0, < 8.0.37
  • pip/dirac:>= 0, < 8.0.37

🔗 References (6)