CVE-2024-36128
CVE-2024-36128 · Directus is soft-locked by providing a string value to random string util
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.
CVSS 7.5 · Élevée · EPSS 0,6% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node