DIRAC's TokenManager does not check permissions on cached tokens
Date: 2024-02
Affected: pip/dirac, pip/DIRAC
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-24825
CWE: CWE-200
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

### Impact Any user could get a token that has been requested by another user/agent ### Patches The vulnerability is fixed in version 8.0.37. ### Workarounds None ### References


Mitigations:

Architectural layers (MAESTRO):