Cross site scripting

2022-01-1016:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

21.5%

JSON

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL.

CPENameOperatorVersion
directuseq9.0.0 rc74
directuseq9.0.0 rc75
directuseq9.0.0 rc76
directuseq9.0.0 rc77
directuseq9.0.0 rc78
directuseq9.0.0 rc79
directuseq9.0.0 rc80
directuseq9.0.0 rc81
directuseq9.0.0 rc82
directuseq9.0.0 rc83

Name	Operator	Version
directus	eq	9.0.0 rc74
directus	eq	9.0.0 rc75
directus	eq	9.0.0 rc76
directus	eq	9.0.0 rc77
directus	eq	9.0.0 rc78
directus	eq	9.0.0 rc79
directus	eq	9.0.0 rc80
directus	eq	9.0.0 rc81
directus	eq	9.0.0 rc82
directus	eq	9.0.0 rc83