CVE-2025-53886

Katalog CVE

CVSS 4.5 · Medium EPSS 0,43%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada monospace directus. Skor CVSS 3.1 4.5 (Medium) menurut github.com.

Deskripsi (NVD)

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue.

Rincian

Terbit di NVD

15 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb patch
• https://github.com/directus/directus/pull/25354 patch
• https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v advisory pihak ketiga
• https://github.com/directus/directus/releases/tag/v11.9.0 release notes