CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36128 – Directus is soft-locked by providing a string value to random string util
https://notcve.org/view.php?id=CVE-2024-36128
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2. Directus es una API y un panel de aplicaciones en tiempo real para administrar el contenido de la base de datos SQL. • https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34708 – Directus allows redacted data extraction on the API through "alias"
https://notcve.org/view.php?id=CVE-2024-34708
Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoided by removing permission to view the sensitive fields entirely from users or roles that should not be able to see them. • https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28238 – Session Token in URL in directus
https://notcve.org/view.php?id=CVE-2024-28238
Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. This issue has been addressed in version 10.10.0. • https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-598: Use of GET Request Method With Sensitive Query Strings •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28239 – URL Redirection to Untrusted Site in OAuth2/OpenID in directus
https://notcve.org/view.php?id=CVE-2024-28239
Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password. • https://docs.directus.io/reference/authentication.html#login-using-sso-providers https://github.com/directus/directus/commit/5477d7d61babd7ffc2f835d399bf79611b15b203 https://github.com/directus/directus/security/advisories/GHSA-fr3w-2p22-6w7p • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27296 – Directus version number disclosure
https://notcve.org/view.php?id=CVE-2024-27296
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer. • https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0 https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •