Information Exposure Through Sent Data Affecting directus package, versions <10.10.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-DIRECTUS-6426984
- published 13 Mar 2024
- disclosed 12 Mar 2024
- credit Unknown
How to fix?
Upgrade directus to version 10.10.0 or higher.
Overview
directus is a Directus is a real-time API and App dashboard for managing SQL database content.
Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the process of reaching the /files page where a JWT is passed through a GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places such as web server logs and browser history. Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user.