CVE-2022-23080

directus - SSRF which leads to internal port scan

EPSS 0.8%CWE-918

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

Produtos afetados

directus · directus

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d808d83 https://www.mend.io/vulnerability-database/CVE-2022-23080