CVE-2024-54151
CVSS V2 None
CVSS V3 None
Description
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.
Overview
- CVE ID
- CVE-2024-54151
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-12-09T20:57:28.365Z
- Last Modified Date
- 2024-12-09T20:57:28.365Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4 | x_refsource_CONFIRM |
| https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-54151 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54151 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-12-10 13:38:44 | Added to TrackCVE |