Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking
Vulnerability Description
SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability Type
授权机制不恰当
Vulnerability Title
scitokens 授权问题漏洞
Vulnerability Description
scitokens是SciTokens开源的一个基于JWT的科学计算令牌库。 SciTokens 1.9.6之前版本存在授权问题漏洞，该漏洞源于Enforcer使用简单前缀匹配验证范围路径，可能导致授权绕过。
CVSS Information
N/A
Vulnerability Type
N/A