CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46990 – SSRF Loopback IP filter bypass in directus
https://notcve.org/view.php?id=CVE-2024-46990
18 Sep 2024 — Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip... • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45596 – Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
https://notcve.org/view.php?id=CVE-2024-45596
10 Sep 2024 — Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated reques... • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b • CWE-524: Use of Cache Containing Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6534 – Directus 10.13.0 - Insecure object reference via PATH presets
https://notcve.org/view.php?id=CVE-2024-6534
15 Aug 2024 — Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover. Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the applica... • https://directus.io • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-6533 – Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
https://notcve.org/view.php?id=CVE-2024-6533
15 Aug 2024 — Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover. • https://directus.io • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39896 – Directus allows SSO User Enumeration
https://notcve.org/view.php?id=CVE-2024-39896
08 Jul 2024 — Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0. Directus es una API y un panel de aplicaciones en tiempo real para admin... • https://github.com/directus/directus/commit/454cb534d6ffa547feb11f4d74b932ae7368dae2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39895 – Directus GraphQL Field Duplication Denial of Service (DoS)
https://notcve.org/view.php?id=CVE-2024-39895
08 Jul 2024 — Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing gr... • https://github.com/directus/directus/commit/543b345695071c1de61a35004bd063fe59dba0c8 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39701 – Directus Incorrectly handles _in` filter
https://notcve.org/view.php?id=CVE-2024-39701
08 Jul 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the **values**. This vulnerability is fixed in 10.6.0. • https://github.com/directus/directus/security/advisories/GHSA-hxgm-ghmv-xjjm • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36128 – Directus is soft-locked by providing a string value to random string util
https://notcve.org/view.php?id=CVE-2024-36128
03 Jun 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2. Directus es una API y un panel de apli... • https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34709 – Directus Lacks Session Tokens Invalidation
https://notcve.org/view.php?id=CVE-2024-34709
13 May 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. T... • https://github.com/directus/directus/commit/a6172f8a6a0f31a6bf4305a090de172ebfb63bcf • CWE-613: Insufficient Session Expiration •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34708 – Directus allows redacted data extraction on the API through "alias"
https://notcve.org/view.php?id=CVE-2024-34708
13 May 2024 — Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoided by removing permission to view the sensitive fields entirely from users... • https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •