What is CVE-2021-26595?

CVE-2021-26595 is a medium-severity vulnerability in Rangerstudio Directus, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.3/10. Published 2021-02-23.

How severe is CVE-2021-26595?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2021-26595 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Rangerstudio Directus

CVE-2021-26595

In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

EPSS: 0.007 (49.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Rangerstudio Directus
N/a — versions n/a

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

Public proof-of-concept exploits

sgranel/directusv8

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-26595?: CVE-2021-26595 is a medium-severity vulnerability in Rangerstudio Directus, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.3/10. Published 2021-02-23.
How severe is CVE-2021-26595?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2021-26595 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.