Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. The searchable columns (numbers & strings) are not checked against permissions when injecting the `where` clauses for applying the search query. This leads to the possibility of enumerating those un-permitted fields. Version 11.5.0 fixes the issue.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Secondary | 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CWE ID | Type | Source |
|---|---|---|
| CWE-200 | Secondary | security-advisories@github.com |
| NVD-CWE-noinfo | Primary | nvd@nist.gov |
| Hyperlink | Source | Resource |
|---|---|---|
| https://github.com/directus/directus/commit/ac5a9964d9926f20dc063a74cb417dc7bbad676d | security-advisories@github.com | Patch |
| https://github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c | security-advisories@github.com | Third Party Advisory |
| https://github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Third Party Advisory |