CVE-2025-53887

Katalog CVE

CVSS 5.3 · Medium EPSS 0,98%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada monospace directus. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Version 11.9.0 fixes the issue.

Rincian

Terbit di NVD

15 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3 patch
• https://github.com/directus/directus/pull/25353 patch
• https://github.com/directus/directus/security/advisories/GHSA-rmjh-cf9q-pv7q advisory pihak ketiga
• https://github.com/directus/directus/releases/tag/v11.9.0 release notes