CVE-2024-39701
Medium
Description
Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the **values**. This vulnerability is fixed in 10.6.0.
SeverityMedium
CVSS6.3
Exploit probability—
Product
Monospace Directus
PublishedJul 8, 2024
First seenJul 8, 2024
Weakness typeCWE-284Improper access control
How to fix
Update
- monospace directus10.6.0 or later
- directus10.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| monospace directus | 9.23.0 ≤ v < 10.6.0 | 10.6.0 |
| directusnpm | 9.23.0 ≤ v < 10.6.0 | 10.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.