CVE-2022-23080

Exploit

EPSS 0.8%
Veröffentlicht 22.06.2022 16:15:07
Zuletzt bearbeitet 21.11.2024 06:47:56
Erkennungen
Login

directus - SSRF which leads to internal port scan

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 114 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Rangerstudio ≫ Directus Version >= 9.0.1 <= 9.6.0

Rangerstudio ≫ Directus Version 9.0.0 Update beta10

Rangerstudio ≫ Directus Version 9.0.0 Update beta11

Rangerstudio ≫ Directus Version 9.0.0 Update beta12

Rangerstudio ≫ Directus Version 9.0.0 Update beta13

Rangerstudio ≫ Directus Version 9.0.0 Update beta14

Rangerstudio ≫ Directus Version 9.0.0 Update beta2

Rangerstudio ≫ Directus Version 9.0.0 Update beta3

Rangerstudio ≫ Directus Version 9.0.0 Update beta4

Rangerstudio ≫ Directus Version 9.0.0 Update beta5

Rangerstudio ≫ Directus Version 9.0.0 Update beta7

Rangerstudio ≫ Directus Version 9.0.0 Update beta8

Rangerstudio ≫ Directus Version 9.0.0 Update beta9

Rangerstudio ≫ Directus Version 9.0.0 Update rc0

Rangerstudio ≫ Directus Version 9.0.0 Update rc1

Rangerstudio ≫ Directus Version 9.0.0 Update rc10

Rangerstudio ≫ Directus Version 9.0.0 Update rc100

Rangerstudio ≫ Directus Version 9.0.0 Update rc101

Rangerstudio ≫ Directus Version 9.0.0 Update rc11

Rangerstudio ≫ Directus Version 9.0.0 Update rc12

Rangerstudio ≫ Directus Version 9.0.0 Update rc13

Rangerstudio ≫ Directus Version 9.0.0 Update rc14

Rangerstudio ≫ Directus Version 9.0.0 Update rc15

Rangerstudio ≫ Directus Version 9.0.0 Update rc17

Rangerstudio ≫ Directus Version 9.0.0 Update rc18

Rangerstudio ≫ Directus Version 9.0.0 Update rc19

Rangerstudio ≫ Directus Version 9.0.0 Update rc2

Rangerstudio ≫ Directus Version 9.0.0 Update rc20

Rangerstudio ≫ Directus Version 9.0.0 Update rc21

Rangerstudio ≫ Directus Version 9.0.0 Update rc22

Rangerstudio ≫ Directus Version 9.0.0 Update rc23

Rangerstudio ≫ Directus Version 9.0.0 Update rc24

Rangerstudio ≫ Directus Version 9.0.0 Update rc25

Rangerstudio ≫ Directus Version 9.0.0 Update rc26

Rangerstudio ≫ Directus Version 9.0.0 Update rc27

Rangerstudio ≫ Directus Version 9.0.0 Update rc28

Rangerstudio ≫ Directus Version 9.0.0 Update rc29

Rangerstudio ≫ Directus Version 9.0.0 Update rc3

Rangerstudio ≫ Directus Version 9.0.0 Update rc30

Rangerstudio ≫ Directus Version 9.0.0 Update rc31

Rangerstudio ≫ Directus Version 9.0.0 Update rc32

Rangerstudio ≫ Directus Version 9.0.0 Update rc33

Rangerstudio ≫ Directus Version 9.0.0 Update rc34

Rangerstudio ≫ Directus Version 9.0.0 Update rc35

Rangerstudio ≫ Directus Version 9.0.0 Update rc36

Rangerstudio ≫ Directus Version 9.0.0 Update rc37

Rangerstudio ≫ Directus Version 9.0.0 Update rc38

Rangerstudio ≫ Directus Version 9.0.0 Update rc39

Rangerstudio ≫ Directus Version 9.0.0 Update rc4

Rangerstudio ≫ Directus Version 9.0.0 Update rc40

Rangerstudio ≫ Directus Version 9.0.0 Update rc41

Rangerstudio ≫ Directus Version 9.0.0 Update rc42

Rangerstudio ≫ Directus Version 9.0.0 Update rc43

Rangerstudio ≫ Directus Version 9.0.0 Update rc44

Rangerstudio ≫ Directus Version 9.0.0 Update rc45

Rangerstudio ≫ Directus Version 9.0.0 Update rc46

Rangerstudio ≫ Directus Version 9.0.0 Update rc47

Rangerstudio ≫ Directus Version 9.0.0 Update rc48

Rangerstudio ≫ Directus Version 9.0.0 Update rc49

Rangerstudio ≫ Directus Version 9.0.0 Update rc5

Rangerstudio ≫ Directus Version 9.0.0 Update rc50

Rangerstudio ≫ Directus Version 9.0.0 Update rc51

Rangerstudio ≫ Directus Version 9.0.0 Update rc52

Rangerstudio ≫ Directus Version 9.0.0 Update rc53

Rangerstudio ≫ Directus Version 9.0.0 Update rc54

Rangerstudio ≫ Directus Version 9.0.0 Update rc55

Rangerstudio ≫ Directus Version 9.0.0 Update rc56

Rangerstudio ≫ Directus Version 9.0.0 Update rc57

Rangerstudio ≫ Directus Version 9.0.0 Update rc58

Rangerstudio ≫ Directus Version 9.0.0 Update rc59

Rangerstudio ≫ Directus Version 9.0.0 Update rc6

Rangerstudio ≫ Directus Version 9.0.0 Update rc60

Rangerstudio ≫ Directus Version 9.0.0 Update rc61

Rangerstudio ≫ Directus Version 9.0.0 Update rc62

Rangerstudio ≫ Directus Version 9.0.0 Update rc63

Rangerstudio ≫ Directus Version 9.0.0 Update rc64

Rangerstudio ≫ Directus Version 9.0.0 Update rc65

Rangerstudio ≫ Directus Version 9.0.0 Update rc66

Rangerstudio ≫ Directus Version 9.0.0 Update rc67

Rangerstudio ≫ Directus Version 9.0.0 Update rc68

Rangerstudio ≫ Directus Version 9.0.0 Update rc69

Rangerstudio ≫ Directus Version 9.0.0 Update rc7

Rangerstudio ≫ Directus Version 9.0.0 Update rc70

Rangerstudio ≫ Directus Version 9.0.0 Update rc71

Rangerstudio ≫ Directus Version 9.0.0 Update rc72

Rangerstudio ≫ Directus Version 9.0.0 Update rc73

Rangerstudio ≫ Directus Version 9.0.0 Update rc74

Rangerstudio ≫ Directus Version 9.0.0 Update rc75

Rangerstudio ≫ Directus Version 9.0.0 Update rc76

Rangerstudio ≫ Directus Version 9.0.0 Update rc77

Rangerstudio ≫ Directus Version 9.0.0 Update rc78

Rangerstudio ≫ Directus Version 9.0.0 Update rc79

Rangerstudio ≫ Directus Version 9.0.0 Update rc8

Rangerstudio ≫ Directus Version 9.0.0 Update rc80

Rangerstudio ≫ Directus Version 9.0.0 Update rc81

Rangerstudio ≫ Directus Version 9.0.0 Update rc82

Rangerstudio ≫ Directus Version 9.0.0 Update rc83

Rangerstudio ≫ Directus Version 9.0.0 Update rc84

Rangerstudio ≫ Directus Version 9.0.0 Update rc85

Rangerstudio ≫ Directus Version 9.0.0 Update rc86

Rangerstudio ≫ Directus Version 9.0.0 Update rc87

Rangerstudio ≫ Directus Version 9.0.0 Update rc88

Rangerstudio ≫ Directus Version 9.0.0 Update rc89

Rangerstudio ≫ Directus Version 9.0.0 Update rc9

Rangerstudio ≫ Directus Version 9.0.0 Update rc90

Rangerstudio ≫ Directus Version 9.0.0 Update rc91

Rangerstudio ≫ Directus Version 9.0.0 Update rc92

Rangerstudio ≫ Directus Version 9.0.0 Update rc93

Rangerstudio ≫ Directus Version 9.0.0 Update rc94

Rangerstudio ≫ Directus Version 9.0.0 Update rc95

Rangerstudio ≫ Directus Version 9.0.0 Update rc96

Rangerstudio ≫ Directus Version 9.0.0 Update rc97

Rangerstudio ≫ Directus Version 9.0.0 Update rc98

Rangerstudio ≫ Directus Version 9.0.0 Update rc99

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.8%	0.536

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5	3.1	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
NIST	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d808d83

Patch

Third Party Advisory

https://www.mend.io/vulnerability-database/CVE-2022-23080

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2022-23080

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-23080

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-23080

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-23080