CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-24353 – Directus privilege escalation vulnerability using Share feature
https://notcve.org/view.php?id=CVE-2025-24353
23 Jan 2025 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue. • https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804 • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47822 – Access token from query string is inserted into logs in Directus
https://notcve.org/view.php?id=CVE-2024-47822
08 Oct 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` i... • https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-46990 – SSRF Loopback IP filter bypass in directus
https://notcve.org/view.php?id=CVE-2024-46990
18 Sep 2024 — Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip... • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45596 – Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
https://notcve.org/view.php?id=CVE-2024-45596
10 Sep 2024 — Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated reques... • https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b • CWE-524: Use of Cache Containing Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39895 – Directus GraphQL Field Duplication Denial of Service (DoS)
https://notcve.org/view.php?id=CVE-2024-39895
08 Jul 2024 — Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing gr... • https://github.com/directus/directus/commit/543b345695071c1de61a35004bd063fe59dba0c8 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-39699 – Directus has a Blind SSRF On File Import
https://notcve.org/view.php?id=CVE-2024-39699
08 Jul 2024 — Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security measure and execute a SSRF using redirects. Directus allows redirects when importing file from the URL and does not check the result URL. • https://github.com/directus/directus/commit/d577b44231c0923aca99cac5770fd853801caee1 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36128 – Directus is soft-locked by providing a string value to random string util
https://notcve.org/view.php?id=CVE-2024-36128
03 Jun 2024 — Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2. Directus es una API y un panel de apli... • https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34708 – Directus allows redacted data extraction on the API through "alias"
https://notcve.org/view.php?id=CVE-2024-34708
13 May 2024 — Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoided by removing permission to view the sensitive fields entirely from users... • https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28238 – Session Token in URL in directus
https://notcve.org/view.php?id=CVE-2024-28238
12 Mar 2024 — Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. This issue has been addressed in version 10.10.0. • https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-598: Use of GET Request Method With Sensitive Query Strings •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28239 – URL Redirection to Untrusted Site in OAuth2/OpenID in directus
https://notcve.org/view.php?id=CVE-2024-28239
12 Mar 2024 — Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate direc... • https://docs.directus.io/reference/authentication.html#login-using-sso-providers • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •