npm/directus CVE-2024-46990: medium 5, EPSS 0.47%
Directus vulnerable to SSRF Loopback IP filter bypass
Action: Upgrade directus to 10.13.3 or later.
npm i directus@10.13.3npm i directus@11.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.13.3 | - |
| 11.0.0 | 11.1.0 | - |
Fixed versions
| 10.13.3 | 11.1.0 |
Sources
- osv: GHSA-68g8-c275-xf2m
- https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m
- https://nvd.nist.gov/vuln/detail/CVE-2024-46990
- https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b
- https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52
- https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff
- https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431
- https://github.com/directus/directus
CVE-2024-46990 · published · modified · JSON