CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28239 – URL Redirection to Untrusted Site in OAuth2/OpenID in directus
https://notcve.org/view.php?id=CVE-2024-28239
Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password. • https://docs.directus.io/reference/authentication.html#login-using-sso-providers https://github.com/directus/directus/commit/5477d7d61babd7ffc2f835d399bf79611b15b203 https://github.com/directus/directus/security/advisories/GHSA-fr3w-2p22-6w7p • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27296 – Directus version number disclosure
https://notcve.org/view.php?id=CVE-2024-27296
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer. • https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0 https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27295 – Directus MySQL accent insensitive email matching
https://notcve.org/view.php?id=CVE-2024-27295
Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insensitive and case-insensitive comparisons. This vulnerability is fixed in version 10.8.3. • https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19850
https://notcve.org/view.php?id=CVE-2020-19850
An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests. • https://github.com/directus/api/issues/982 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-28443 – directus vulnerable to Insertion of Sensitive Information into Log File
https://notcve.org/view.php?id=CVE-2023-28443
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3. • https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13 https://github.com/directus/directus/commit/349536303983ccba68ecb3e4fb35315424011afc https://github.com/directus/directus/security/advisories/GHSA-8vg2-wf3q-mwv7 • CWE-284: Improper Access Control CWE-532: Insertion of Sensitive Information into Log File •