PT-2022-15253 · Directus · Directus

Published 2022-01-10 · Updated 2022-01-14 · CVE-2022-22116

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Directus versions 9.0.0-alpha.4 through 9.4.1

Description The issue is related to a stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in the media upload functionality. A low-privileged attacker can inject arbitrary JavaScript code, which will be executed in a victim's browser when they open the image URL.

Recommendations For versions 9.0.0-alpha.4 through 9.4.1, consider disabling the media upload functionality, specifically the SVG file upload feature, until a patch is available. Restrict access to the media upload module to minimize the risk of exploitation. Avoid using the media upload functionality in the affected versions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22116

Affected Products

Directus

References · 6

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2022-22116 · Exploit
• https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-22116 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22116 · Vendor Advisory
• https://t.me/cvenotify/25155 · Telegram Post
• https://t.me/cibsecurity/35177 · Telegram Post