GitHub Advisoryadvisory · npm

GHSA-5mhg-wv8w-p59j Directus version number disclosure

MEDIUM Published 2024-03-01 Modified 2024-03-01 Official page ↗
Aliases
CVE-2024-27296
Ecosystem
npm
Packages
directus
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-03-01

Affected packages

• npm directus: < 10.8.3 → fixed in 10.8.3

Description

Impact Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Patches The problem has been resolved in versions 10.8.3 and newer Workarounds None

Related

Alias · CVE (1)

  • CVE-2024-27296 Directus is a real-time API and App dashboard for managing SQL database content. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References