CVE-2024-28238

CVSS V2 None CVSS V3 None
Description
Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. This issue has been addressed in version 10.10.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Overview
  • CVE ID
  • CVE-2024-28238
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-03-12T20:24:28.321Z
  • Last Modified Date
  • 2024-03-12T20:24:28.321Z
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CWE-598 http://cwe.mitre.org/data/definitions/598.html
References
Reference URL Reference Tags
https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677 x_refsource_CONFIRM
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-28238
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28238
History
Created Old Value New Value Data Type Notes
2024-06-26 08:05:08 Added to TrackCVE