{"id":"GHSA-v988-828w-xvf2","aliases":[],"status":"published","title":"Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui","description":"### Impact\n`rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated.\n\nRucio server / daemons are not affected by this issue, it is isolated to the webui.\n\n### Patches\nThis issue is fixed in the `1.26.7` release of the `rucio-webui`.\n\n### Workarounds\nInstallation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue.\n\n### References\nhttps://github.com/rucio/rucio/issues/4928","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288","CWE-305"],"published":"2021-10-22T16:21:07Z","modified":"2025-02-13T05:31:28Z","fixes":[{"ecosystem":"PyPI","package":"rucio-webui","fixed_in":["1.26.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"1.26.7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rucio-webui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"1.26.7"}]}],"versions":["1.26.0","1.26.1","1.26.1.post1","1.26.2","1.26.4","1.26.5","1.26.6"]}],"references":[{"url":"https://github.com/rucio/rucio/security/advisories/GHSA-v988-828w-xvf2","tags":["web"]},{"url":"https://github.com/rucio/rucio/issues/4810","tags":["web"]},{"url":"https://github.com/rucio/rucio/issues/4928","tags":["web"]},{"url":"https://github.com/rucio/rucio/releases/tag/1.26.7","tags":["web"]},{"url":"https://github.com/rucio/rucio/commit/8f832404ae88d6300e17d7e706b40fe58e0df90c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v988-828w-xvf2"},{"url":"https://github.com/rucio/rucio","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-v988-828w-xvf2","title":"Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui","description":"### Impact\n`rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated.\n\nRucio server / daemons are not affected by this issue, it is isolated to the webui.\n\n### Patches\nThis issue is fixed in the `1.26.7` release of the `rucio-webui`.\n\n### Workarounds\nInstallation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue.\n\n### References\nhttps://github.com/rucio/rucio/issues/4928","status":"published","published":"2021-10-22T16:21:07Z","modified":"2023-04-20T21:43:05Z","cwes":["CWE-288","CWE-305"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"osv":[{"id":"GHSA-v988-828w-xvf2","title":"Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui","description":"### Impact\n`rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated.\n\nRucio server / daemons are not affected by this issue, it is isolated to the webui.\n\n### Patches\nThis issue is fixed in the `1.26.7` release of the `rucio-webui`.\n\n### Workarounds\nInstallation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue.\n\n### References\nhttps://github.com/rucio/rucio/issues/4928","status":"published","published":"2021-10-22T16:21:07Z","modified":"2025-02-13T05:31:28.532416Z","cwes":["CWE-288","CWE-305"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}