CVE-2024-24825: fallo crítico en DIRACGrid DIRAC
TokenManager not checking permissions on cached tokens in DIRAC
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.5%
DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
DIRACGrid · DIRACCVEs relacionadas — DIRACGrid DIRAC
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-61667CRITICALDIRAC: RCE in FileCatalog DatasetManager via SQL injection + evalEPSS 1.2%CVE-2026-45579CRITICALDIRAC: RCE in RequestManager due to eval on untrusted inputEPSS 0.9%CVE-2026-61668HIGHDIRAC: Pilot code downloaded over unverified HTTPS connectionEPSS 0.4%CVE-2024-29905HIGHDIRAC: Unauthorized users can read proxy contents during generationEPSS 0.3%