Information Exposure Affecting directus package, versions >=10.3.0 <10.5.0
Threat Intelligence
EPSS
0.06% (29th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-DIRECTUS-5805292
- published 26 Jul 2023
- disclosed 25 Jul 2023
- credit madc
Introduced: 25 Jul 2023
CVE-2023-38503 Open this link in a new tabHow to fix?
Upgrade directus to version 10.5.0 or higher.
Overview
directus is a Directus is a real-time API and App dashboard for managing SQL database content.
Affected versions of this package are vulnerable to Information Exposure. The permission filters (i.e. user_created IS $CURRENT_USER) are not properly checked when using GraphQL subscription, resulting in unauthorized users getting events on their subscription, which they should not receive according to the permissions.
References
CVSS Scores
version 3.1