Password reset vulnerability in Directus backend allows attackers to receive password reset email of a victim user

CVE-2024-27295

What is CVE-2024-27295?

The vulnerability presents a significant security concern in Directus, a real-time API and App dashboard for managing SQL database content. The flaw resides in the password reset mechanism, where attackers can exploit the configuration of MySQL/MariaDB that allows for accent-insensitive and case-insensitive email comparisons. This enables an attacker to receive a password reset email intended for a victim user, by using an email address that appears similar but contains accented characters. The vulnerability has been addressed in Directus version 10.8.3, highlighting the importance of upgrading to mitigate potential risks.

References