npm/@directus/api CVE-2024-45596: high 7.4, EPSS 0.66%
Session is cached for OpenID and OAuth2 if `redirect` is not used
Action: Upgrade @directus/api to 21.0.1 or later.
npm i @directus/api@21.0.1npm i @directus/api@22.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 21.0.1 | - |
| 22.0.0 | 22.2.0 | - |
Fixed versions
| 21.0.1 | 22.2.0 |
Sources
- osv: GHSA-cff8-x7jv-4fm8#npm/@directus/api
- https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8
- https://nvd.nist.gov/vuln/detail/CVE-2024-45596
- https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b
- https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52
- https://github.com/directus/directus
- https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428
- https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459
CVE-2024-45596 · published · modified · JSON