GHSA-5mhg-wv8w-p59j

Directus version number disclosure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-27296

Packages

Ecosystem	Package	Affected	Fixed in
npm	directus	< 10.8.3	10.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. ### Patches The problem has been resolved in versions 10.8.3 and newer ### Workarounds None

References

External links from the advisory. They lead to third-party sites.

https://github.com/directus/directus/security/advisories/GHSA-5mhg-wv8w-p59j web
https://nvd.nist.gov/vuln/detail/CVE-2024-27296 advisory
https://github.com/directus/directus/commit/a5a1c26ac48795ed3212a4c51b9523588aff4fa0 web
https://github.com/directus/directus package