CVE-2024-24825 - CVE House
Back to Database
Status published Critical CVE-2024-24825

TokenManager not checking permissions on cached tokens in DIRAC

Vulnerability Description

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-24825

Credits & Attribution

No credits recorded in the NVD database.

References

More from DIRACGrid

View All →
CVE-2025-54066
DiracX-Web login page has Open Redirect vulnerability
Medium 4.7
CVE-2024-29905
DIRAC: Unauthorized users can read proxy contents during generation
High 8.1

Affected Vendor

Affected Software

DIRAC
Vulnerable Versions:
>= 8.0.0, < 8.0.37

Timeline

Official Publish: February 8th, 2024
Last Modified: June 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration