CVE-2025-24353

Katalog CVE

CVSS 4.3 · Medium EPSS 0,39%

Kerentanan Improper Privilege Management pada monospace directus. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.

Rincian

Terbit di NVD

23 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg exploit · advisory vendor
• https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804 patch
• https://www.youtube.com/watch?v=DbV4IxbWzN4 exploit
• https://github.com/directus/directus/pull/23716 issue tracking
• https://github.com/directus/directus/releases/tag/v11.2.0 release notes