CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39701 – Directus Incorrectly handles _in` filter
https://notcve.org/view.php?id=CVE-2024-39701
08 Jul 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the **values**. This vulnerability is fixed in 10.6.0. • https://github.com/directus/directus/security/advisories/GHSA-hxgm-ghmv-xjjm • CWE-284: Improper Access Control •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-39699 – Directus has a Blind SSRF On File Import
https://notcve.org/view.php?id=CVE-2024-39699
08 Jul 2024 — Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security measure and execute a SSRF using redirects. Directus allows redirects when importing file from the URL and does not check the result URL. • https://github.com/directus/directus/commit/d577b44231c0923aca99cac5770fd853801caee1 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36128 – Directus is soft-locked by providing a string value to random string util
https://notcve.org/view.php?id=CVE-2024-36128
03 Jun 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2. Directus es una API y un panel de apli... • https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34708 – Directus allows redacted data extraction on the API through "alias"
https://notcve.org/view.php?id=CVE-2024-34708
13 May 2024 — Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoided by removing permission to view the sensitive fields entirely from users... • https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28238 – Session Token in URL in directus
https://notcve.org/view.php?id=CVE-2024-28238
12 Mar 2024 — Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. This issue has been addressed in version 10.10.0. • https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-598: Use of GET Request Method With Sensitive Query Strings •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28239 – URL Redirection to Untrusted Site in OAuth2/OpenID in directus
https://notcve.org/view.php?id=CVE-2024-28239
12 Mar 2024 — Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate direc... • https://docs.directus.io/reference/authentication.html#login-using-sso-providers • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27296 – Directus version number disclosure
https://notcve.org/view.php?id=CVE-2024-27296
01 Mar 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer. • https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27295 – Directus MySQL accent insensitive email matching
https://notcve.org/view.php?id=CVE-2024-27295
01 Mar 2024 — Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insensitive and case-insensitive comparisons. This vulnerability is fixed in version 10.8.3. • https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45820 – Directus crashes on invalid WebSocket message
https://notcve.org/view.php?id=CVE-2023-45820
19 Oct 2023 — Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. • https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38503 – Directus has Incorrect Permission Checking for GraphQL Subscriptions
https://notcve.org/view.php?id=CVE-2023-38503
25 Jul 2023 — Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription resulting in unauthorized users getting event on their subscription which they should not be receiving according to the permissions. This can be any collection but out-of-the box the `directus_users` collection is configured with such a permissions filter ... • https://github.com/directus/directus/pull/19155 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •