CVSS: 5.0EPSS: 0%CPEs: 114EXPL: 1CVE-2022-23080 – directus - SSRF which leads to internal port scan
https://notcve.org/view.php?id=CVE-2022-23080
In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans. En directus versiones v9.0.0-beta.2 hasta 9.6.0, son vulnerables a un ataque de tipo server-side request forgery (SSRF) en la funcionalidad media upload que permite a un usuario poco privilegiado realizar escaneos de puertos de red internos • https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d808d83 https://www.mend.io/vulnerability-database/CVE-2022-23080 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24814 – Cross-site Scripting in Directus
https://notcve.org/view.php?id=CVE-2022-24814
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-you-see-is-what-you-get by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface. • https://github.com/directus/directus/pull/12020 https://github.com/directus/directus/releases/tag/v9.7.0 https://github.com/directus/directus/security/advisories/GHSA-xmjj-3c76-5w84 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 153EXPL: 1CVE-2022-22117 – Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image
https://notcve.org/view.php?id=CVE-2022-22117
In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered. En Directus, versiones 9.0.0-alpha.4 hasta 9.4.1 permiten una carga sin restricciones de archivos .html en la funcionalidad media upload, lo que conlleva a una vulnerabilidad de tipo Cross-Site Scripting. Un atacante con pocos privilegios puede subir un archivo HTML diseñado como un avatar de perfil, y cuando un administrador u otro usuario lo abre, la carga útil de tipo XSS es desencadenada • https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22117 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 153EXPL: 1CVE-2022-22116 – Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload
https://notcve.org/view.php?id=CVE-2022-22116
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL. En Directus, versiones 9.0.0-alpha.4 hasta 9.4.1 son susceptibles a una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenada por medio de una carga de archivos SVG en la funcionalidad media upload. Un atacante con pocos privilegios puede inyectar código javascript arbitrario que será ejecutado en el navegador de la víctima cuando abra la URL de la imagen • https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22116 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 4CVE-2021-29641 – Monospace Directus Headless CMS File Upload / Rule Bypass
https://notcve.org/view.php?id=CVE-2021-29641
Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com). Directus 8 versiones anteriores a 8.8.2, permite a los usuarios autenticados remotamente ejecutar código arbitrario porque los permisos de carga de archivos incluyen la capacidad de cargar un archivo .php en el directorio de carga principal y/o cargar un archivo .php y un archivo .htaccess en un subdirectorio. La explotación tiene éxito solo para ciertas instalaciones con el servidor HTTP Apache y el controlador de almacenamiento local (por ejemplo, cuando el producto se obtuvo de hub.docker.com) Monospace Directus Headless CMS versions prior to 8.8.2 suffers from .htaccess rule bypass and arbitrary file upload vulnerabilities. • http://packetstormsecurity.com/files/162118/Monospace-Directus-Headless-CMS-File-Upload-Rule-Bypass.html http://seclists.org/fulldisclosure/2021/Apr/14 https://hub.docker.com/layers/directus/directus/v8.8.2-apache/images/sha256-d9898b6442b0150c3c377b50e706757f35d2d563bd82ddaf97f3ae4ba450a6e6?context=explore https://sec-consult.com/de/vulnerability-lab/advisory/arbitrary-file-upload-and-bypassing-htaccess-rules-in-monospace-directus-headless-cms https://sec-consult.com/vulnerability-lab/advisory/arbitrary-file-upload-and-bypassing-htaccess-rules • CWE-434: Unrestricted Upload of File with Dangerous Type •