CVE-2023-28443CWE-284CWE-532

directus vulnerable to Insertion of Sensitive Information into Log File

Medium · published March 23, 2023

CVSS v3.1
4.2
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.6th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-532 · Insertion of Sensitive Information into Log File
Published
2023-03-23T23:13Z
EPSS history
Timeline
  • 23 MAR 23:13Z
    directus vulnerable to Insertion of Sensitive Information into Log File
    cvelistv5