PT-2023-21151 · Directus · Directus

Tofra · Published 2023-03-06 · Updated 2023-03-13 · CVE-2023-27474

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 9.23.0

Description Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. An attacker could exploit this to email users URLs to the server's domain but which may contain malicious code.

Recommendations For versions prior to 9.23.0, upgrade to 9.23.0 or later. Alternatively, remove the custom reset URL from the configured allow list. As a temporary workaround, consider disabling the custom reset URL allow list until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-27474

GHSA-4HMQ-GGRM-QFC6

Affected Products

Directus

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27474.json · Exploit
• https://github.com/directus/directus/security/advisories/GHSA-4hmq-ggrm-qfc6 · Vendor Advisory
• https://github.com/directus/directus/pull/17120 · Patch
• https://osv.dev/vulnerability/GHSA-4hmq-ggrm-qfc6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27474 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27474 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/issues/17119 · Note
• https://t.me/cibsecurity/59498 · Telegram Post