CVE-2024-54151 — Sensitive Information Exposure in Directus

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 40.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Monospace DirectusDirectus APIDirectus
Timeline
PublishedDec 9

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe fo…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶npmdirectus/api22.2.0 — 23.2.0
▶npmdirectus/directus11.0.0 — 11.3.0
▶NVDmonospace/directus11.0.0 — 11.3.0
▶CVEListV5directus/directus>= 11.0.0, < 11.3.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

2
OSV
Directus allows unauthenticated access to WebSocket events and operations↗2024-12-09
▶
GHSA
Directus allows unauthenticated access to WebSocket events and operations↗2024-12-09
▶