GoogleOSV:CVE-2024-27296CVE-2024-27296
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
7.5 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer.
| CPE | Name | Operator | Version |
|---|---|---|---|
| directus | eq | 9.20.1 | |
| directus | eq | 9.8.0 | |
| directus | eq | 9.0.0-rc.82 | |
| directus | eq | 9.25.1 | |
| directus | eq | 9.25.2 | |
| directus | eq | 9.0.0-rc.80 | |
| directus | eq | 9.2.2 | |
| directus | eq | 9.0.0-alpha.41 | |
| directus | eq | 9.0.0-rc.38 | |
| directus | eq | 9.0.0-rc.40 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
7.5 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%