Broken Access Control Vulnerability in Directus <= v10.5.3
CVE-2024-39701

6.3MEDIUM

Key Information:

Vendor

Directus

Status
Directus
Vendor
CVE Published:
8 July 2024

What is CVE-2024-39701?

Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if field matches any of the values. This vulnerability is fixed in 10.6.0.

Affected Version(s)

directus >= 9.23.0, < 10.6.0

References

https://github.com/directus/directus/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.