Directus vulnerable to unhandled exception on illegal filename_disk value

中 6.5CVE-2022-36031 · GHSA-77qm-wvqq-fg79 · 19/08/2022 公開 · 17/06/2026 更新

要点

CVE-2022-36031 は directus (monospace), directus に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.97%（全脆弱性の 61.9% より高い）。
対処：9.15.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
directus monospace	`< 9.15.0`	`9.15.0`
directus npm	`< 9.15.0`	`9.15.0`

概要

The Directus process can be aborted by having an authorized user update the filename_disk value to a folder and accessing that file through the /assets endpoint.

The vulnerability is patched and released in v9.15.0.

You can prevent this problem by making sure no (untrusted) non-admin users have permissions to update the filename_disk field on directus_files.

For more information

If you have any questions or comments about this advisory:

Open a Discussion in directus/directus
Email us at [email protected]

Credits

This vulnerability was first discovered and reported by Witold Gorecki.

NVD の説明

Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. This vulnerability has been patched and release v9.15.0 contains the fix. Users are advised to upgrade. Users unable to upgrade may prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.

参考情報

directus/directus security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-36031 · ADVISORY
directus/directus · PACKAGE

directus のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

directus

monospace

< 9.15.0

9.15.0