Lucene search
HistoryJun 22, 2022 - 4:15 p.m.
CVE-2022-23080
cve-2022-23080
directus
ssrf
vulnerability
network scans
nvd
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
5.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
21.6%
In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.
Affected configurations
Node
rangerstudiodirectusRange9.0.1–9.6.0
ORrangerstudiodirectusMatch9.0.0beta10
ORrangerstudiodirectusMatch9.0.0beta11
ORrangerstudiodirectusMatch9.0.0beta12
ORrangerstudiodirectusMatch9.0.0beta13
ORrangerstudiodirectusMatch9.0.0beta14
ORrangerstudiodirectusMatch9.0.0beta2
ORrangerstudiodirectusMatch9.0.0beta3
ORrangerstudiodirectusMatch9.0.0beta4
ORrangerstudiodirectusMatch9.0.0beta5
ORrangerstudiodirectusMatch9.0.0beta7
ORrangerstudiodirectusMatch9.0.0beta8
ORrangerstudiodirectusMatch9.0.0beta9
ORrangerstudiodirectusMatch9.0.0rc0
ORrangerstudiodirectusMatch9.0.0rc1
ORrangerstudiodirectusMatch9.0.0rc10
ORrangerstudiodirectusMatch9.0.0rc100
ORrangerstudiodirectusMatch9.0.0rc101
ORrangerstudiodirectusMatch9.0.0rc11
ORrangerstudiodirectusMatch9.0.0rc12
ORrangerstudiodirectusMatch9.0.0rc13
ORrangerstudiodirectusMatch9.0.0rc14
ORrangerstudiodirectusMatch9.0.0rc15
ORrangerstudiodirectusMatch9.0.0rc17
ORrangerstudiodirectusMatch9.0.0rc18
ORrangerstudiodirectusMatch9.0.0rc19
ORrangerstudiodirectusMatch9.0.0rc2
ORrangerstudiodirectusMatch9.0.0rc20
ORrangerstudiodirectusMatch9.0.0rc21
ORrangerstudiodirectusMatch9.0.0rc22
ORrangerstudiodirectusMatch9.0.0rc23
ORrangerstudiodirectusMatch9.0.0rc24
ORrangerstudiodirectusMatch9.0.0rc25
ORrangerstudiodirectusMatch9.0.0rc26
ORrangerstudiodirectusMatch9.0.0rc27
ORrangerstudiodirectusMatch9.0.0rc28
ORrangerstudiodirectusMatch9.0.0rc29
ORrangerstudiodirectusMatch9.0.0rc3
ORrangerstudiodirectusMatch9.0.0rc30
ORrangerstudiodirectusMatch9.0.0rc31
ORrangerstudiodirectusMatch9.0.0rc32
ORrangerstudiodirectusMatch9.0.0rc33
ORrangerstudiodirectusMatch9.0.0rc34
ORrangerstudiodirectusMatch9.0.0rc35
ORrangerstudiodirectusMatch9.0.0rc36
ORrangerstudiodirectusMatch9.0.0rc37
ORrangerstudiodirectusMatch9.0.0rc38
ORrangerstudiodirectusMatch9.0.0rc39
ORrangerstudiodirectusMatch9.0.0rc4
ORrangerstudiodirectusMatch9.0.0rc40
ORrangerstudiodirectusMatch9.0.0rc41
ORrangerstudiodirectusMatch9.0.0rc42
ORrangerstudiodirectusMatch9.0.0rc43
ORrangerstudiodirectusMatch9.0.0rc44
ORrangerstudiodirectusMatch9.0.0rc45
ORrangerstudiodirectusMatch9.0.0rc46
ORrangerstudiodirectusMatch9.0.0rc47
ORrangerstudiodirectusMatch9.0.0rc48
ORrangerstudiodirectusMatch9.0.0rc49
ORrangerstudiodirectusMatch9.0.0rc5
ORrangerstudiodirectusMatch9.0.0rc50
ORrangerstudiodirectusMatch9.0.0rc51
ORrangerstudiodirectusMatch9.0.0rc52
ORrangerstudiodirectusMatch9.0.0rc53
ORrangerstudiodirectusMatch9.0.0rc54
ORrangerstudiodirectusMatch9.0.0rc55
ORrangerstudiodirectusMatch9.0.0rc56
ORrangerstudiodirectusMatch9.0.0rc57
ORrangerstudiodirectusMatch9.0.0rc58
ORrangerstudiodirectusMatch9.0.0rc59
ORrangerstudiodirectusMatch9.0.0rc6
ORrangerstudiodirectusMatch9.0.0rc60
ORrangerstudiodirectusMatch9.0.0rc61
ORrangerstudiodirectusMatch9.0.0rc62
ORrangerstudiodirectusMatch9.0.0rc63
ORrangerstudiodirectusMatch9.0.0rc64
ORrangerstudiodirectusMatch9.0.0rc65
ORrangerstudiodirectusMatch9.0.0rc66
ORrangerstudiodirectusMatch9.0.0rc67
ORrangerstudiodirectusMatch9.0.0rc68
ORrangerstudiodirectusMatch9.0.0rc69
ORrangerstudiodirectusMatch9.0.0rc7
ORrangerstudiodirectusMatch9.0.0rc70
ORrangerstudiodirectusMatch9.0.0rc71
ORrangerstudiodirectusMatch9.0.0rc72
ORrangerstudiodirectusMatch9.0.0rc73
ORrangerstudiodirectusMatch9.0.0rc74
ORrangerstudiodirectusMatch9.0.0rc75
ORrangerstudiodirectusMatch9.0.0rc76
ORrangerstudiodirectusMatch9.0.0rc77
ORrangerstudiodirectusMatch9.0.0rc78
ORrangerstudiodirectusMatch9.0.0rc79
ORrangerstudiodirectusMatch9.0.0rc8
ORrangerstudiodirectusMatch9.0.0rc80
ORrangerstudiodirectusMatch9.0.0rc81
ORrangerstudiodirectusMatch9.0.0rc82
ORrangerstudiodirectusMatch9.0.0rc83
ORrangerstudiodirectusMatch9.0.0rc84
ORrangerstudiodirectusMatch9.0.0rc85
ORrangerstudiodirectusMatch9.0.0rc86
ORrangerstudiodirectusMatch9.0.0rc87
ORrangerstudiodirectusMatch9.0.0rc88
ORrangerstudiodirectusMatch9.0.0rc89
ORrangerstudiodirectusMatch9.0.0rc9
ORrangerstudiodirectusMatch9.0.0rc90
ORrangerstudiodirectusMatch9.0.0rc91
ORrangerstudiodirectusMatch9.0.0rc92
ORrangerstudiodirectusMatch9.0.0rc93
ORrangerstudiodirectusMatch9.0.0rc94
ORrangerstudiodirectusMatch9.0.0rc95
ORrangerstudiodirectusMatch9.0.0rc96
ORrangerstudiodirectusMatch9.0.0rc97
ORrangerstudiodirectusMatch9.0.0rc98
ORrangerstudiodirectusMatch9.0.0rc99
| CPE | Name | Operator | Version |
|---|---|---|---|
| rangerstudio:directus | rangerstudio directus | le | 9.6.0 |
| rangerstudio:directus | rangerstudio directus | eq | 9.0.0 |
CNA Affected
[
{
"product": "directus",
"vendor": "directus",
"versions": [
{
"lessThan": "unspecified",
"status": "affected",
"version": "v9.0.0-beta.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "v9.6.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]References
Social References
More
Related
osv
osv
CVE-2022-23080
2022-06-22 16:15:07
Server-Side Request Forgery in Directus
2022-06-23 00:00:33
Directus vulnerable to Server-Side Request Forgery On File Import
2023-03-03 23:07:35
cvelist
cvelist
CVE-2022-23080 directus - SSRF which leads to internal port scan
2022-01-11 00:00:00
prion
prion
Server side request forgery (ssrf)
2022-06-22 16:15:00
veracode
veracode
Server-Side Request Forgery (SSRF)
2022-06-23 07:56:23
Server-side Request Forgery (SSRF)
2023-03-12 12:40:23
nvd
nvd
CVE-2022-23080
2022-06-22 16:15:07
github
github
Server-Side Request Forgery in Directus
2022-06-23 00:00:33
Directus vulnerable to Server-Side Request Forgery On File Import
2023-03-03 23:07:35
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
5.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
21.6%
Related for CVE-2022-23080