Headline
GHSA-5mhg-wv8w-p59j: Directus version number disclosure
Impact
Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.
Patches
The problem has been resolved in versions 10.8.3 and newer
Workarounds
None
Package
npm directus (npm)
Affected versions
<= 10.8.2
Description
Impact
Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version.
Patches
The problem has been resolved in versions 10.8.3 and newer
Workarounds
None
References
- GHSA-5mhg-wv8w-p59j
- https://nvd.nist.gov/vuln/detail/CVE-2024-27296
- directus/directus@a5a1c26
Published to the GitHub Advisory Database
Mar 1, 2024