PT-2021-17522 · Directus · Directus

Arnaud Courty + 1 · Published 2021-02-23 · Updated 2024-08-03 · CVE-2021-27583

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions 8.x through 8.8.1

Description An attacker can discover whether a user is present in the database through the password reset feature. This issue only affects products that are no longer supported by the maintainer.

Recommendations For versions 8.x through 8.8.1, as a temporary workaround, consider disabling the password reset feature until a patch is available. However, since these versions are no longer supported, it is recommended to upgrade to a supported version if possible. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2021-27583

Affected Products

Directus

References · 6

• 🔥 https://github.com/sgranel/directusv8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27583 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27583 · Vendor Advisory
• https://t.me/cibsecurity/24029 · Telegram Post
• https://t.me/cvenotify/10678 · Telegram Post
• https://t.me/cvenotify/88851 · Telegram Post