CVE-2019-13984

Directus 7 API before 2.3.0 does not validate uploaded files

published July 19, 2019

CVSS
—
EPSS
2%
Percentile
75.7
In the wild
Unconfirmed
What it is

Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01608 · 75.7th percentile
Published
2019-07-19T14:17Z
EPSS history
Timeline
  • 19 JUL 14:17Z
    Directus 7 API before 2.3.0 does not validate uploaded files
    cvelistv5