CVE-2025-24353

Jan. 23, 2025, 6:15 p.m.

5.0
Medium

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.

Product(s) Impacted

Product Versions
Directus
  • ['before 11.2.0']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References

https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804
https://github.com/directus/directus/pull/23716
https://github.com/directus/directus/releases/tag/v11.2.0
https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg
https://www.youtube.com/watch?v=DbV4IxbWzN4

Tags

security-advisories@github.com
CWE-269
2025-01-23
CVE-2025-24353

CVSS Score

5.0 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: CHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

    View Vector String

Timeline

Published: Jan. 23, 2025, 6:15 p.m.
Last Modified: Jan. 23, 2025, 6:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.