Description

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

Remediation

References

https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d808d83

https://www.mend.io/vulnerability-database/CVE-2022-23080

Related Vulnerabilities

CVE-2022-23302 Vulnerability in maven package log4j:log4j

CVE-2020-15125 Vulnerability in npm package auth0

CVE-2021-28168 Vulnerability in maven package org.glassfish.jersey.core:jersey-common

CVE-2021-25943 Vulnerability in npm package 101

CVE-2022-45462 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-alert-plugins

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Tags

Patch Third Party Advisory Exploit NVD-CWE-noinfo