CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24814 – Cross-site Scripting in Directus
https://notcve.org/view.php?id=CVE-2022-24814
04 Apr 2022 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-yo... • https://github.com/directus/directus/pull/12020 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 153EXPL: 1CVE-2022-22117 – Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image
https://notcve.org/view.php?id=CVE-2022-22117
10 Jan 2022 — In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered. En Directus, versiones 9.0.0-alpha.4 hasta 9.4.1 permiten una carga sin restricciones de archivos .html en la funcionalidad media upload, lo que conlleva a una vulnerabilidad d... • https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 153EXPL: 1CVE-2022-22116 – Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload
https://notcve.org/view.php?id=CVE-2022-22116
10 Jan 2022 — In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL. En Directus, versiones 9.0.0-alpha.4 hasta 9.4.1 son susceptibles a una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenada por medio de una carga de archivos SVG en la funcionalidad media upload. U... • https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •