PT-2021-17068 · Directus · Directus

Arnaud Courty + 1 · Published 2021-02-23 · Updated 2024-08-03 · CVE-2021-26595

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions 8.x through 8.8.1

Description An attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by viewing the result of the "api-aa" endpoint, which is called automatically upon a connection. This issue only affects products that are no longer supported by the maintainer.

Recommendations For versions 8.x through 8.8.1, consider disabling the "api-aa" endpoint to prevent information disclosure until a patch is available, however, since these versions are no longer supported, updating to a supported version is recommended if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-26595

Affected Products

Directus

References · 5

• 🔥 https://github.com/sgranel/directusv8 · Exploit
• https://osv.dev/vulnerability/CVE-2021-26595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26595 · Security Note
• https://t.me/cibsecurity/24024 · Telegram Post
• https://t.me/cvenotify/10680 · Telegram Post