npm/@directus/api CVE-2024-46990: medium 5, EPSS 0.47%
Directus vulnerable to SSRF Loopback IP filter bypass
Action: Upgrade @directus/api to 21.0.0 or later.
npm i @directus/api@21.0.0npm i @directus/api@22.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 21.0.0 | - |
| 22.0.0 | 22.1.1 | - |
Fixed versions
| 21.0.0 | 22.1.1 |
Sources
- osv: GHSA-68g8-c275-xf2m#npm/@directus/api
- https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m
- https://nvd.nist.gov/vuln/detail/CVE-2024-46990
- https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b
- https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52
- https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff
- https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431
- https://github.com/directus/directus
CVE-2024-46990 · published · modified · JSON