npm/directus CVE-2024-45596: high 7.4, EPSS 0.66%
Session is cached for OpenID and OAuth2 if `redirect` is not used
Action: Upgrade directus to 10.13.3 or later.
npm i directus@10.13.3npm i directus@11.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.13.3 | - |
| 11.0.0-rc.1 | 11.1.0 | - |
Fixed versions
| 10.13.3 | 11.1.0 |
Sources
- osv: GHSA-cff8-x7jv-4fm8
- https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8
- https://nvd.nist.gov/vuln/detail/CVE-2024-45596
- https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b
- https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52
- https://github.com/directus/directus
- https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428
- https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459
CVE-2024-45596 · published · modified · JSON