CVE-2024-24825: TokenManager not checking permissions on cached tokens in DIRAC

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-09 · updated 2026-06-17
Weakness: CWE-200

Description

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

DIRACGrid DIRAC: before 8.0.37 — fixed in 8.0.37

How to fix

Upgrade to a fixed version: DIRACGrid DIRAC 8.0.37. Check the vendor advisory for mitigations.

References

https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c
https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j
https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c
https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j

Get alerted when CVE-2024-24825 or the next vulnerability affects your stack