In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.1 | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| Primary | 2.0 | 3.5 | LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| CWE ID | Type | Source |
|---|---|---|
| CWE-79 | Primary | vulnerabilitylab@mend.io |
| Hyperlink | Source | Resource |
|---|---|---|
| https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 | vulnerabilitylab@mend.io | Patch Third Party Advisory |
| https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22116 | vulnerabilitylab@mend.io | Exploit Third Party Advisory |