@directus/api (>=15.0.0, <=19.1.1), directus-extension-baetorra-booking (>=1.2.0, <=2.0.0) potentially affected by CVE-2024-36128 via directus (>=10.8.3, <=10.11.1)

directus NPM version =10.8.3, =15.0.0, =1.2.0, =2.0.0 Source cves: CVE-2024-36128 Source advisory: OSV:GHSA-632P-P495-25M5...

CVE-2024-36128

Directus (Real-time API/dashboard for SQL databases) is affected by CVE-2024-36128 prior to version 10.11.2. Providing a non-numeric length to the random string generation utility triggers a memory issue that disrupts random session IDs, causing a denial of service where logged-in sessions can no...

CVE-2024-36128 Directus is soft-locked by providing a string value to random string util

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of...