Lucene search

K
nvd[email protected]NVD:CVE-2024-39896
HistoryJul 08, 2024 - 6:15 p.m.

CVE-2024-39896

2024-07-0818:15:08
CWE-200
web.nvd.nist.gov
11
directus
sso
user enumeration
vulnerability
sql
database
content
email
address
authentication
api
dashboard
error
fix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

9.2%

Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a “helpful” error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

9.2%

Related for NVD:CVE-2024-39896