directus vulnerable to Insertion of Sensitive Information into Log File
CVE-2023-28443

4.2MEDIUM

Key Information:

Vendor

Directus

Status
Directus
Vendor
CVE Published:
24 March 2023

What is CVE-2023-28443?

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the directus_refresh_token is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.

Affected Version(s)

directus < 9.23.3

References

https://github.com/directus/directus/security/advisories/...
x_refsource_CONFIRM
https://github.com/directus/directus/commit/349536303983c...
x_refsource_MISC
https://github.com/directus/directus/blob/7c479c5161639aa...
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.