Code injection

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

Design/Logic Flaw

Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File...

Remote code execution

In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...

CVE-2019-13979

Affected software: Directus 7 API (Directus 7) before version 2.2.1. Vulnerability details: The uploader does not block PHP file uploads, which can be stored under uploads/_/originals and lead to remote code execution. Root cause (as stated): failure to block PHP uploads. Impact: remote code exec...

CVE-2019-13979

In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads//originals remote code execution...

CVE-2019-13980

Directus 7 API (up to version 2.3.0) permits PHP uploads only when using Apache; with nginx, uploads/_/originals can lead to remote code execution. No exploitation details are provided in the given documents beyond this risk description. Remediation/patch details are not included in the connected...

CVE-2019-13982

interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

CVE-2019-13984

Directus 7 API before 2.3.0 fails to validate uploaded files; regardless of extension or MIME type there is a direct link to each uploaded file, accessible by unauthenticated users. Root cause: missing file validation in the upload flow, enabling access to uploaded content (as demonstrated by the...