PT-2022-18147 · Directus · Directus

Rijk Van Zanten · Published 2022-04-05 · Updated 2023-01-05 · CVE-2022-26969

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Directus versions prior to 9.7.0

Description The default settings of CORS ORIGIN and CORS ENABLED in Directus are true, which could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. This is due to the default value for the CORS ENABLED and CORS ORIGIN configuration being very permissive.

Recommendations For versions prior to 9.7.0, configure the CORS environment variables to match your project's usage, rather than leaving them at the permissive defaults. Update to version 9.7.0 or later, where the default values for CORS have been changed to be less permissive.

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2022-26969

GHSA-G27J-74FP-XFPR

Affected Products

Directus

References · 11

• https://github.com/directus/directus/pull/12022 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-26969 · Security Note
• https://osv.dev/vulnerability/GHSA-g27j-74fp-xfpr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26969 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/security/advisories/GHSA-g27j-74fp-xfpr · Note
• https://github.com/directus/directus/blob/8daed9c41baeaf1d08c1e292bf9f0dcef65e48fb/docs/configuration/config-options.md · Note
• https://github.com/directus/directus/releases/tag/v9.7.0 · Note
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS · Note
• https://t.me/cvenotify/40689 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-DIRECTUS-2441822 · Note