← Voltar para CVEs

CVE-2024-27296

MEDIUM

5.3

Descricao

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer.

Detalhes CVE

Pontuacao CVSS v3.15.3

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado3/1/2024

Ultima modificacao1/3/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

monospace:directus

Fraquezas (CWE)

CWE-200

Referencias

https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0(security-advisories@github.com)

https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j(security-advisories@github.com)

https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.