CVE-2022-23080

Description

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

Related CPE's

arangerstudiodirectus9.0.0rc74******

arangerstudiodirectus9.0.0rc75******

arangerstudiodirectus9.0.0rc76******

arangerstudiodirectus9.0.0rc77******

arangerstudiodirectus9.0.0rc78******

arangerstudiodirectus9.0.0rc79******

arangerstudiodirectus9.0.0rc80******

arangerstudiodirectus9.0.0rc81******

arangerstudiodirectus9.0.0rc82******

arangerstudiodirectus9.0.0rc100******

References

N/A

ExploitThird Party Advisory

N/A

PatchThird Party Advisory

CvssV3 impact

Could not find any metrics

CvssV2 impact

AccessComplexity

LOW

ConfidentialityImpact

PARTIAL

AvailabilityImpact

NONE

IntegrityImpact

NONE

BaseScore

4

VectorString

AV:N/AC:L/Au:S/C:P/I:N/A:N

Version

2.0

AccessVector

NETWORK

Authentication

SINGLE

Created by Yello
About Severity.io