Server-Side Request Forgery in Directus

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-23080 · ADVISORY
• directus/directus commit 6da3f1e · WEB
• directus/directus · PACKAGE
• mend.io/vulnerability-database/CVE-2022-23080 · WEB

directus のその他の脆弱性

• CVE-2023-27474中 5.4Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerab…
• CVE-2022-24814中 6.1Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be…
• CVE-2022-22117中 5.4In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which lea…
• CVE-2022-22116中 5.4In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in m…
• CVE-2021-29641高 8.8Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to u…