PT-2023-29709 · Directus · Directus

Nles · Publicado 2023-10-19 · Atualizado 2023-10-25 · CVE-2023-45820

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Directus versions prior to 10.6.2

Description Directus is a real-time API and App dashboard for managing SQL database content. In affected versions, any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus.

Recommendations For versions prior to 10.6.2, upgrade to version 10.6.2 to resolve the issue. For users unable to upgrade, avoid using websockets as a temporary workaround to minimize the risk of exploitation.

Exploit

Correção

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

Identificadores relacionados

CVE-2023-45820

GHSA-HMGW-9JRG-HF2M

Produtos afetados

Directus

Referências · 11

• 🔥 https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45820.json · Exploit
• https://github.com/directus/directus · Nota
• https://github.com/directus/directus/releases/tag/v10.6.2 · Nota
• https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb · Correção
• https://osv.dev/vulnerability/CVE-2023-45820 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45820 · Nota de Segurança
• https://twitter.com/CVEnew/status/1715078734946939158 · Publicação no Twitter
• https://t.me/cibsecurity/72605 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-hmgw-9jrg-hf2m · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1715107875616350527 · Publicação no Twitter