CVE-2021-26593
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information about the user (such as email address, first name, and last name) but also the secret for 2FA if one exists. This secret can be regenerated. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
En Directus versiones 8.xa hasta 8.8.1, un atacante puede visualizar a todos los usuarios en el CMS usando la API /users/{id}. Para cada llamada, obtienen en respuesta una gran cantidad de información sobre el usuario (tal y como la dirección de correo electrónico, el nombre y el apellido), pero también el secreto de 2FA si existe. Este secreto puede ser regenerado. NOTA: Esta vulnerabilidad solo afecta a los productos que ya no son compatibles con el mantenedor
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-02-02 CVE Reserved
- 2021-02-23 CVE Published
- 2024-06-28 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/sgranel/directusv8 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rangerstudio Search vendor "Rangerstudio" | Directus Search vendor "Rangerstudio" for product "Directus" | >= 8.0.0 <= 8.8.1 Search vendor "Rangerstudio" for product "Directus" and version " >= 8.0.0 <= 8.8.1" | - |
Affected
| ||||||