PT-2023-29709 · Directus · Directus

Nles · Published 2023-10-19 · Updated 2023-10-25 · CVE-2023-45820

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Directus versions prior to 10.6.2

Description Directus is a real-time API and App dashboard for managing SQL database content. In affected versions, any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus.

Recommendations For versions prior to 10.6.2, upgrade to version 10.6.2 to resolve the issue. For users unable to upgrade, avoid using websockets as a temporary workaround to minimize the risk of exploitation.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2023-45820

GHSA-HMGW-9JRG-HF2M

Affected Products

Directus

References · 11

• 🔥 https://github.com/directus/directus/security/advisories/GHSA-hmgw-9jrg-hf2m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45820.json · Exploit
• https://github.com/directus/directus/commit/243eed781b42d6b4948ddb8c3792bcf5b44f55bb · Patch
• https://osv.dev/vulnerability/CVE-2023-45820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45820 · Security Note
• https://osv.dev/vulnerability/GHSA-hmgw-9jrg-hf2m · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/releases/tag/v10.6.2 · Note
• https://twitter.com/CVEnew/status/1715078734946939158 · Twitter Post
• https://t.me/cibsecurity/72605 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1715107875616350527 · Twitter Post