directus (11.0.0-rc.3) potentially affected by CVE-2024-47822 via @directus/api (21.0.0-rc.0)

@directus/api NPM version 21.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - directus 11.0.0-rc.3 Source cves: CVE-2024-47822 Source advisory: OSV:GHSA-VW58-PH65-6RXP...

directus (11.0.0-rc.3) potentially affected by CVE-2024-47822 via @directus/api (21.0.0-rc.0)

@directus/api NPM version 21.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - directus 11.0.0-rc.3 Source cves: CVE-2024-47822 Source advisory: GHSA-VW58-PH65-6RXP...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

@deconz-community/directus-extension-ddf-store (0.1.0), @meta-factory/cms (0.1.1) +8 more potentially affected by CVE-2024-47822 via @directus/api (>=9.25.0, <=21.0.0-rc.0)

@directus/api NPM version =9.25.0, =0.1.0, =9.25.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2024-47822 Source advisory: MEND:CVE-2024-47822...

CVE-2024-47822

creationtimestamp| type| source ---|---|--- 2024-10-08 12:52:21+00:00| published-proof-of-concept| https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp 2024-10-08 21:14:13+00:00| seen| https://t.me/cvedetector/7393...