CVE-2023-45820 — Improper Handling of Exceptional Conditions in Directus

CWE-755 — Improper Handling of Exceptional Conditions3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 41.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Monospace DirectusDirectus
Timeline
PublishedOct 19

Description

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶npmdirectus/directus10.4.0 — 10.6.2
▶NVDmonospace/directus10.4.0 — 10.6.2
▶CVEListV5directus/directus>=10.4, < 10.6.2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
Directus crashes on invalid WebSocket message↗2023-10-19
▶
GHSA
Directus crashes on invalid WebSocket message↗2023-10-19
▶