p PatchFirst

CVE-2022-23080

CVE-2022-23080 · directus - SSRF which leads to internal port scan

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

CVSS 5.0 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • directus

    Versions
    • ≥ v9.0.0-beta.10, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ v9.6.0: Affected (custom)

    No fix published

  • directus npm

    Affected ranges
    • SEMVER: ≥ 9.0.0-beta.2, < 9.7.0

    Update to 9.7.0

Original sources

Check your server →