5.5

CVE-2023-28443

Exploit

directus vulnerable to Insertion of Sensitive Information into Log File

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Monospace ≫ Directus SwPlatformnode.js Version < 9.23.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.226
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 4.2 0.6 3.6
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13
Vendor Advisory
https://github.com/directus/directus/commit/349536303983ccba68ecb3e4fb35315424011afc
Patch
https://github.com/directus/directus/security/advisories/GHSA-8vg2-wf3q-mwv7
Vendor Advisory
Exploit