CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26969
https://notcve.org/view.php?id=CVE-2022-26969
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. En Directus anterior a 9.7.0, la configuración predeterminada de CORS_ORIGIN y CORS_ENABLED es verdadera. • https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://github.com/directus/directus/blob/8daed9c41baeaf1d08c1e292bf9f0dcef65e48fb/docs/configuration/config-options.md https://github.com/directus/directus/pull/12022 https://github.com/directus/directus/releases/tag/v9.7.0 https://security.snyk.io/vuln/SNYK-JS-DIRECTUS-2441822 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-36031 – Unhandled exception on illegal filename_disk value
https://notcve.org/view.php?id=CVE-2022-36031
Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`. • https://github.com/directus/directus/security/advisories/GHSA-77qm-wvqq-fg79 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24814 – Cross-site Scripting in Directus
https://notcve.org/view.php?id=CVE-2022-24814
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-you-see-is-what-you-get by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface. • https://github.com/directus/directus/pull/12020 https://github.com/directus/directus/releases/tag/v9.7.0 https://github.com/directus/directus/security/advisories/GHSA-xmjj-3c76-5w84 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 4CVE-2021-29641 – Monospace Directus Headless CMS File Upload / Rule Bypass
https://notcve.org/view.php?id=CVE-2021-29641
Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com). Directus 8 versiones anteriores a 8.8.2, permite a los usuarios autenticados remotamente ejecutar código arbitrario porque los permisos de carga de archivos incluyen la capacidad de cargar un archivo .php en el directorio de carga principal y/o cargar un archivo .php y un archivo .htaccess en un subdirectorio. La explotación tiene éxito solo para ciertas instalaciones con el servidor HTTP Apache y el controlador de almacenamiento local (por ejemplo, cuando el producto se obtuvo de hub.docker.com) Monospace Directus Headless CMS versions prior to 8.8.2 suffers from .htaccess rule bypass and arbitrary file upload vulnerabilities. • http://packetstormsecurity.com/files/162118/Monospace-Directus-Headless-CMS-File-Upload-Rule-Bypass.html http://seclists.org/fulldisclosure/2021/Apr/14 https://hub.docker.com/layers/directus/directus/v8.8.2-apache/images/sha256-d9898b6442b0150c3c377b50e706757f35d2d563bd82ddaf97f3ae4ba450a6e6?context=explore https://sec-consult.com/de/vulnerability-lab/advisory/arbitrary-file-upload-and-bypassing-htaccess-rules-in-monospace-directus-headless-cms https://sec-consult.com/vulnerability-lab/advisory/arbitrary-file-upload-and-bypassing-htaccess-rules • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-26595
https://notcve.org/view.php?id=CVE-2021-26595
In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer En Directus versiones 8.xa hasta 8.8.1, un atacante puede aprender información confidencial tal y como la versión del CMS, la versión de PHP utilizada por el sitio y el nombre del DBMS, simplemente al visualizar el resultado de la api-aa, llamado automáticamente en una conexión. NOTA: Esta vulnerabilidad solo afecta a los productos que ya no son compatibles con el mantenedor • https://github.com/sgranel/directusv8 • CWE-312: Cleartext Storage of Sensitive Information •