CVSS: 4.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47822 – Access token from query string is inserted into logs in Directus
https://notcve.org/view.php?id=CVE-2024-47822
Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` is set to `raw`. • https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46990 – SSRF Loopback IP filter bypass in directus
https://notcve.org/view.php?id=CVE-2024-46990
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`. • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52 https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431 https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m • CWE-284: Improper Access Control •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45596 – Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
https://notcve.org/view.php?id=CVE-2024-45596
Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0. • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52 https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8 • CWE-524: Use of Cache Containing Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39896 – Directus allows SSO User Enumeration
https://notcve.org/view.php?id=CVE-2024-39896
Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0. Directus es una API y un panel de aplicaciones en tiempo real para administrar el contenido de la base de datos SQL. • https://github.com/directus/directus/commit/454cb534d6ffa547feb11f4d74b932ae7368dae2 https://github.com/directus/directus/security/advisories/GHSA-jgf4-vwc3-r46v • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39895 – Directus GraphQL Field Duplication Denial of Service (DoS)
https://notcve.org/view.php?id=CVE-2024-39895
Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. • https://github.com/directus/directus/commit/543b345695071c1de61a35004bd063fe59dba0c8 https://github.com/directus/directus/security/advisories/GHSA-7hmh-pfrp-vcx4 • CWE-400: Uncontrolled Resource Consumption •