directus@11.3.0 vulnerabilities

Directus is a real-time API and App dashboard for managing SQL database content

latest version

11.3.5

first published

4 years ago

latest version published

2 days ago

licenses detected

BUSL-1.1
>=10.0.0

View directus package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the directus package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Authorization Bypass Through User-Controlled Key directus is a Directus is a real-time API and App dashboard for managing SQL database content. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the `POST /presets` and PATCH requests. An authenticated attacker can modify presets created by the same user to assign them to another user by exploiting the lack of validation for the user parameter in the PATCH request. Note: When chained with CVE-2024-6533, it could result in account takeover. How to fix Authorization Bypass Through User-Controlled Key? There is no fixed version for `directus`.	*
M Cross-site Scripting (XSS) directus is a Directus is a real-time API and App dashboard for managing SQL database content. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an attacker-controlled parameter that is stored on the server and subsequently used unsanitized in a DOM element. An attacker can execute arbitrary JavaScript on the client by injecting malicious code into this parameter. Note: When chained with CVE-2024-6534, it could result in account takeover. How to fix Cross-site Scripting (XSS)? There is no fixed version for `directus`.	*

Authorization Bypass Through User-Controlled Key

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the POST /presets and PATCH requests. An authenticated attacker can modify presets created by the same user to assign them to another user by exploiting the lack of validation for the user parameter in the PATCH request.

Note:

When chained with CVE-2024-6533, it could result in account takeover.

How to fix Authorization Bypass Through User-Controlled Key?

There is no fixed version for directus.

Cross-site Scripting (XSS)

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an attacker-controlled parameter that is stored on the server and subsequently used unsanitized in a DOM element. An attacker can execute arbitrary JavaScript on the client by injecting malicious code into this parameter.

Note:

When chained with CVE-2024-6534, it could result in account takeover.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for directus.

Go back to all versions of this package