~ / search / GHSA-5h75-pvq4-82c9

GHSA-5h75-pvq4-82c9

Server-Side Request Forgery in Directus

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-23080

Packages

EcosystemPackageAffectedFixed in
npm directus >= 9.0.0-beta.2, < 9.7.0 9.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

Directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality, which allows a low privileged user to perform internal network port scans.

References

External links from the advisory. They lead to third-party sites.