CVE-2022-23080 directus - SSRF which leads to internal port scan

2022-01-1100:00:00

CWE-918

Mend

www.cve.org

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

CNA Affected

[
  {
    "product": "directus",
    "vendor": "directus",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "v9.0.0-beta.10",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "v9.6.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]