CVE-2024-46990CWE-284

SSRF Loopback IP filter bypass in directus

Medium · published September 18, 2024

CVSS v3.1
5.0
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-09-18T16:55Z
EPSS history
Timeline
  • 18 SEP 16:55Z
    SSRF Loopback IP filter bypass in directus
    cvelistv5