PT-2024-20591 · Dirac · Dirac

Aldbr + 2 · Published 2024-02-08 · Updated 2024-02-16 · CVE-2024-24825

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DIRAC versions prior to 8.0.37

Description DIRAC is a distributed resource framework. In affected versions, any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties.

Recommendations For versions prior to 8.0.37, upgrade to release version 8.0.37 to address the issue. There are no known workarounds for this vulnerability. As a temporary workaround, consider restricting access to token requests until the upgrade is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-24825

GHSA-59QJ-JCJV-662J

PYSEC-2024-125

Affected Products

Dirac

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24825.json · Exploit
• https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c · Patch
• https://osv.dev/vulnerability/GHSA-59qj-jcjv-662j · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24825 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24825 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/dirac/PYSEC-2024-125.yaml · Note
• https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j · Note
• https://github.com/DIRACGrid/DIRAC/commit/9487921684e2925b4cf72d6c423718cf4950f3fe · Note
• https://github.com/DIRACGrid/DIRAC · Note
• https://t.me/cvenotify/71826 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1755770268897743032 · Twitter Post
• https://twitter.com/CVEnew/status/1755741414485532755 · Twitter Post
• https://twitter.com/cracbot/status/1756906216906002853 · Twitter Post
• https://twitter.com/cracbot/status/1757283504759677031 · Twitter Post