Vulnerability · Published Dec 5, 2024 · Assigned by GitHub_M
CVE-2024-54128Directus has an HTML Injection in Comment
Medium 5.7
In plain English
A medium-severity security flaw in directus from directus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @directus/app | 13.3.1 | GHSA-r6wx-627v-gh2f |
| npm | directus | 10.13.4 | GHSA-r6wx-627v-gh2f |
| npm | directus | 11.2.2 | GHSA-r6wx-627v-gh2f |
Affected products (as reported)
Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f x_refsource_CONFIRM