| Package | Affected versions | Patched versions |
|---|---|---|
| directus | < 9.7.0 | 9.7.0 |
| directus | < 9.7.0 | 9.7.0 |
The default value for the CORS_ENABLED and CORS_ORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.
The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0
Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free