Kurz gesagt
- CVE-2024-24825 ist eine Schwachstelle (HOCH (CVSS 7.5)) in dirac, dirac (diracgrid).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.53%, höher als bei 45.1% aller Schwachstellen.
- Abhilfe: auf 8.0.37 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| dirac PyPI | ≥ 8.0.0, < 8.0.37< 8.0.37
| 8.0.37
|
| dirac | < 8.0.37
| 8.0.37
|
Description
Impact
Any user could get a token that has been requested by another user/agent
Patches
The vulnerability is fixed in version 8.0.37.
Workarounds
None
References
NVD description
DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free