Information disclosure in Directus
CVE-2024-27296
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer.
Vulnerability class: Information Disclosure
EPSS: 0.006 (43.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Directus — versions < 10.8.3
- Monospace Directus
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-27296?
- CVE-2024-27296 is a medium-severity vulnerability in Directus, classified under Information Disclosure. CVSS score: 5.3/10. Published 2024-03-01.
- How severe is CVE-2024-27296?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2024-27296 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.