Tofra

**Name of the Vulnerable Software and Affected Versions** Directus versions prior to 9.23.0 **Description** Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. An attacker could exploit this to email users URLs to the server's domain but which may contain malicious code. **Recommendations** For versions prior to 9.23.0, upgrade to 9.23.0 or later. Alternatively, remove the custom reset URL from the configured allow list. As a temporary workaround, consider disabling the custom reset URL allow list until a patch is available.