Improper Access Control

2024-07-0906:35:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

directus

vulnerability

improper access control

handling

operators

attacker

query expressions

empty arrays

unauthorized access

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

AI Score

6.6

Confidence

High

JSON

directus is vulnerable to Improper Access Control. The vulnerability is due to improper handling of _in and _nin operators, which allows an attacker to query expressions with empty arrays, which are evaluated as valid, resulting in unauthorized access.