CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30353 – Directus's webhook trigger flows can leak sensitive data
https://notcve.org/view.php?id=CVE-2025-30353
26 Mar 2025 — Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended ... • https://github.com/directus/directus/security/advisories/GHSA-fm3h-p9wm-h74h • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30352 – Directus `search` query parameter allows enumeration of non permitted fields
https://notcve.org/view.php?id=CVE-2025-30352
26 Mar 2025 — Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. The searchable columns (numbers & strings) are not checked against permissions when injecting the `where` clauses for applying the search query. This leads to the possibility... • https://github.com/directus/directus/commit/ac5a9964d9926f20dc063a74cb417dc7bbad676d • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30351 – Suspended Directus user can continue to use session token to access API
https://notcve.org/view.php?id=CVE-2025-30351
26 Mar 2025 — Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in `verifySessionJWT` to verify that a user is actually still active and allowed to access the API. One can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has be... • https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771 • CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30350 – Directus's S3 assets become unavailable after a burst of HEAD requests
https://notcve.org/view.php?id=CVE-2025-30350
26 Mar 2025 — Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of HEAD requests. Some tools use Directus to sync content and assets, and some of those tools use the HEAD method to check the existence of files. When making many HEAD requests at once, at some point, all a... • https://github.com/directus/directus/security/advisories/GHSA-rv78-qqrq-73m5 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-30225 – Directus's S3 assets become unavailable after a burst of malformed transformations
https://notcve.org/view.php?id=CVE-2025-30225
26 Mar 2025 — Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of malformed transformations. When making many malformed transformation requests at once, at some point, all assets are served as 403. This causes denial of assets for all policies of Directus, including Adm... • https://github.com/directus/directus/security/advisories/GHSA-j8xj-7jff-46mx • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-24353 – Directus privilege escalation vulnerability using Share feature
https://notcve.org/view.php?id=CVE-2025-24353
23 Jan 2025 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue. • https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804 • CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-54128 – Directus has an HTML Injection in Comment
https://notcve.org/view.php?id=CVE-2024-54128
05 Dec 2024 — Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTM... • https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47822 – Access token from query string is inserted into logs in Directus
https://notcve.org/view.php?id=CVE-2024-47822
08 Oct 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` i... • https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46990 – SSRF Loopback IP filter bypass in directus
https://notcve.org/view.php?id=CVE-2024-46990
18 Sep 2024 — Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip... • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45596 – Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
https://notcve.org/view.php?id=CVE-2024-45596
10 Sep 2024 — Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated reques... • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b • CWE-524: Use of Cache Containing Sensitive Information •