icon

We found results for “

WS-2021-0407

Good to know:

icon

Date: August 19, 2025

rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the webui within a close timeframe, thus allowing users to access the webui with the leaked authentication token. Privileges are therefore also escalated. Rucio server / daemons are not affected by this issue, it is isolated to the webui. This issue is fixed in the 1.26.7 release of the rucio-webui.

Language: Python

Severity Score

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

Authentication Bypass Using an Alternate Path or Channel

CWE-288

Authentication Bypass by Primary Weakness

CWE-305

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us