CVE-2024-54151

HIGH EPSS 43.2%
Published Dec 9, 20241y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Dec 9, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
43.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 1

VendorProductVersionRange
monospacedirectus*≥11.0.0  –  <11.3.0

References 2

  • github.com https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21
    Patch
  • github.com https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21
    Patch